Measures for the Administration of Personal Information Protection Compliance Audits

The threshold is the single factual entry point to this regime, so first count — and evidence — how many individuals’ personal information is processed. Write the methodology down: a de-duplicated count of identifiable natural persons, covering active users, dormant users, deactivated accounts still inside the retention window, end users reached through an SDK or entrusted processing, individuals captured offline, and non-product data such as employees and candidates; and set explicit rules for merging users who overlap across product lines and legal entities, without which each self-check produces a different number. Once more than 10 million individuals’ personal information is processed, an audit is required at least every two years (Art. 4). Falling below the threshold is not an exemption: Art. 3 requires the processor to have its internal function or an engaged institution audit compliance “regularly”, so the company must fix its own cycle in writing — commonly aligned with the annual internal-control or security assessment cadence. File each count, the basis and date of the determination, and the scheduled date of the next audit; that file is the only material that shows a regulator the cycle has not been allowed to slip.

Applies when

Every personal information processor processing personal information in China, and especially consumer-facing AI products with fast-growing user bases.

Deadline: Processors handling more than 10 million individuals’ personal information: at least one compliance audit every two years

Evidence to retain

• · Policy defining the headcount methodology: scope, de-duplication rules, cross-entity merge rules
• · Headcount results for each period with an explanation of the data sources
• · Threshold determination record: conclusion, basis, assessor, date
• · Audit cycle schedule showing the previous and next audit dates
• · Written decision fixing a self-determined audit cycle where the threshold is not met

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Art. 6 requires both self-initiated and mandated audits to follow the annexed Guidelines, whose 27 sections amount to a ready-made audit programme: lawful basis and consent (including re-consent after changes, separate consent and written consent); processing rules set out as a list with the shortest necessary retention period; notice that is prominent and readable; agreements and supervision for joint and entrusted processing; notice when personal information transfers on a merger, restructuring, division or dissolution; separate consent and a prior impact assessment before providing personal information to others; transparency, fairness and a refusal mechanism for automated decision-making; consent-based public disclosure; necessity and signage for image-collection equipment in public places; the limits on processing already-public personal information; sensitive personal information and minors under 14; the three outbound routes and approval before providing information to foreign judicial or law-enforcement authorities; the six grounds for deletion and the duty to stop processing where deletion is technically infeasible; handling and responding to individuals exercising their rights; explaining the processing rules; internal management systems and operating procedures (classification, emergency mechanisms, impact assessment and audit systems, complaints, operating permissions, training, performance appraisal, and accountability for unlawful processing); the effectiveness of security technical measures (confidentiality, integrity and availability, encryption and de-identification, access control); coverage and assessment of training; the personal information protection officer’s qualifications, authority and registration with the authority; the conduct and content of impact assessments; the comprehensiveness of emergency plans and drills; incident response; and, for major platforms, platform rules and the personal information protection social responsibility report. In practice: map all 27 sections onto your own systems, data flows and policy documents to produce working papers with four columns — review point, evidence, owner, conclusion. For AI companies the recurring gaps are the lawful basis for training corpora, retention and deletion of conversation logs, whether personal information in models and logs can actually be deleted, and explanations of automated decisions in recommendation and risk control; evidence those first.

Applies when

Processors running a self-initiated or mandated audit, and the engaged professional institution.

Evidence to retain

• · Audit plan: scope, sampling method, schedule and division of responsibility
• · Working papers mapped section by section to the 27 Guidelines items (review point, evidence, owner, conclusion)
• · Inventory of processing activities and data-flow diagrams covering training, inference and logging
• · Sample lawful-basis and consent records, including separate consent, written consent and re-consent after changes
• · Explanatory materials for automated decisions, the refusal mechanism, and evidence of the non-profiled option
• · Prior impact assessments for sensitive personal information and for minors under 14
• · Materials determining the outbound route: security assessment, standard contract filing, or certification
• · Execution records and technical notes on giving effect to deletion in applications, logs, backups and models
• · Internal management systems and operating procedures, training and assessment records, emergency plans and drill records
• · List of audit findings with the remediation plan

Estimated first-time effort: 20–60 person-days (estimate, not a commitment)

This is the mandatory track alongside self-audits, and the regulator sets the tempo. Three triggers (Art. 5): processing that carries significant risk such as serious impact on individual rights or a serious lack of security measures; processing that may infringe the rights of numerous individuals; or a personal information security incident causing the leakage, alteration, loss or destruction of more than 1 million individuals’ personal information or more than 100,000 individuals’ sensitive personal information. The same incident or risk may not be made the basis of a second mandated audit, which is a point to raise if a duplicate demand arrives. Once mandated: select the professional institution as the protection department requires (it is not a free choice), complete the audit within the time limit, and, where the matter is complex, obtain the department’s approval for a reasonable extension (Art. 9); provide the support the institution needs and bear the cost (Art. 8); file the institution’s audit report with the department on completion, signed by the institution’s principal and by the audit lead and bearing the institution’s seal (Art. 10); and remediate the findings as required, filing a remediation report WITHIN 15 WORKING DAYS OF COMPLETING THE FIXES (Art. 11). In practice, build this chain into the incident response plan: once an incident’s severity reaches the 1 million / 100,000-sensitive scale, start preparing for a possible mandated audit in parallel — shortlist institutions, identify the budget line and settle the cooperation posture — rather than beginning the search after the clock has already started.

Applies when

Processors required by the CAC or another department performing personal information protection duties to run a compliance audit; a company that has suffered a large-scale incident should treat the trigger as highly likely.

Deadline: Complete the audit within the time limit set by the protection department (extendable with approval where complex); file the remediation report within 15 working days of completing the fixes

Evidence to retain

• · The protection department’s audit demand and the internal record starting the response
• · Selection process and engagement contract for the professional institution, including confidentiality and post-engagement deletion clauses
• · Records of the audit cost borne and of the support provided to the institution
• · The compliance audit report issued by the institution, signed by its principal and the audit lead and sealed
• · Record and acknowledgement of filing the audit report with the protection department
• · Remediation register: issue, action, owner, completion date, verification result
• · Remediation report and the filing record showing delivery within 15 working days of completing the fixes
• · Extension request and the department’s approval, where applicable

Estimated first-time effort: 20–60 person-days (estimate, not a commitment)

Art. 12 attaches the audit work to named people and bodies. First: a processor handling more than 1 million individuals’ personal information must appoint a personal information protection officer responsible for the organisation’s compliance audit work — note that this threshold (1 million) sits below the 10 million mark that triggers the mandatory two-year cycle, so many companies hit “you need an officer” before “you need a scheduled audit”. Section 22 of the Guidelines adds what is reviewed about that officer: relevant experience and professional knowledge and familiarity with the applicable laws and regulations; clearly defined duties and sufficient authority to coordinate internal departments; the right to give views before major processing decisions are taken; the power to stop non-compliant operations and take necessary corrective measures; and publication of the officer’s contact details, with the name and contact details filed with the protection department. Second: a processor providing important internet platform services with a very large user base and complex business types must set up an independent body composed mainly of external members to supervise the compliance audit — “mainly external” means a committee dominated by internal executives does not qualify, and the membership, rules of procedure and supervisory conclusions all need to be documented.

Applies when

Processors handling more than 1 million individuals’ personal information (the officer); processors providing important internet platform services with a very large user base and complex business types (the independent oversight body).

Evidence to retain

• · Appointment document and delegation of authority for the personal information protection officer
• · Officer qualification materials: relevant experience, professional knowledge and training records
• · Records of the officer giving views before major processing decisions
• · Records of the officer stopping non-compliant operations and taking corrective measures
• · Screenshot of the published contact details and the record of filing the name and contact details with the protection department
• · Establishment document for the independent oversight body, its membership list and the proportion of external members
• · The oversight body’s rules of procedure, meeting minutes and supervisory conclusions on the compliance audit

Estimated first-time effort: 5–20 person-days (estimate, not a commitment)

The engaging party has to control four things itself, or the problem only surfaces at the moment of engagement. (1) Capability (Art. 7): the institution must be capable of performing the audit, with audit personnel, premises, facilities and funding commensurate with the service, and is encouraged to be certified under the Regulations on Certification and Accreditation — keep verification materials on its personnel, premises, facilities and past work. (2) Confidentiality and deletion (Art. 13): the institution owes confidentiality over the personal information, trade secrets and confidential business information obtained, must not disclose or unlawfully provide it to others, and must delete it promptly once the audit work ends — write both into the engagement contract and obtain a deletion confirmation at closeout. (3) No sub-delegation (Art. 14): the institution may not sub-delegate the audit, so the contract needs an explicit prohibition and a liability clause. (4) Rotation (Art. 15): the same institution and its affiliates, and the same audit lead, may not audit the same subject more than three times consecutively. This is the rule most often discovered at the fourth engagement, because “affiliates” and “same audit lead” are not fields in ordinary vendor management records; keep a dedicated engagement-history register keyed on institution, affiliate relationship and audit lead, and check it before requesting quotes.

Applies when

Processors engaging a professional institution for the audit, whether on their own initiative or as required by the protection department.

Evidence to retain

• · Capability verification materials: auditors’ credentials, premises and facilities, funding, and certification where held
• · Contract clauses on confidentiality, post-engagement deletion and the prohibition on sub-delegation
• · Deletion confirmation letter obtained at closeout
• · Engagement-history register: institution, affiliate relationships, audit lead, and the years of each engagement
• · Record of the consecutive-engagement check run before this selection

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)