ChinaPersonal Information Protection Law, compliance audit of personal information handling
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- periodic
- Who audits it
- Self, Independent third party
As of .
What it requires
- Audit, at regular intervals, whether your processing of personal information complies with laws and administrative regulations (PIPL Article 54), through your own internal body or a specialized institution you commission (Measures Article 3).
- If you process the personal information of more than 10 million people, conduct a personal information protection compliance audit at least once every two years (Measures Article 4).
- If you process the personal information of 1 million or more people, designate a person in charge of personal information protection who is responsible for your compliance audit work (Measures Article 12).
- If you provide an important internet platform service, with a very large number of users and complex types of business, set up an independent body made up mainly of external members to oversee your compliance audits (Measures Article 12).
- Refer to the Personal Information Protection Compliance Audit Guidelines annexed to the Measures when you audit (Measures Article 6).
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 54 of the Personal Information Protection Law requires a personal information handler to audit, at regular intervals, its compliance with laws and administrative regulations in processing personal information. Under the Measures for the Administration of Personal Information Protection Compliance Audits, a handler that audits itself does so through its own internal body or by commissioning a specialized institution.
A handler that processes the personal information of more than 10 million people must conduct a compliance audit at least once every two years. A handler that processes the personal information of 1 million or more people must designate a person in charge of personal information protection who is responsible for its compliance audit work.
A handler that provides an important internet platform service, has a very large number of users and runs complex types of business must set up an independent body made up mainly of external members to oversee its compliance audits. The Measures took effect on . The Measures do not apply to a compliance audit of a state organ or of an organization authorized by law or regulation to manage public affairs.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings or processes biometric data.