--- title: "China's compliance-audit rule makes personal-data checks a recurring duty" date: 2026-10-27 category: Policy & Governance site: NeuroAI canonical: https://neuroai.site/a/na-personal-info-compliance-audit-rules language: en --- # China's compliance-audit rule makes personal-data checks a recurring duty > CAC Order No. 18, effective May 1, 2025, requires large personal-information handlers to audit every two years and lets regulators trigger audits after breaches. A company that collects personal information (个人信息) from more than 10 million people now has a fixed calendar item: a compliance audit at least once every two years, conducted or commissioned by a qualified body, with the results on file. The duty comes from the *Measures for the Administration of Personal Information Protection Compliance Audits* (个人信息保护合规审计管理办法), a Cyberspace Administration of China (国家互联网信息办公室) order that took effect on May 1, 2025. Adopted at the CAC's 15th executive meeting on May 20, 2024 and promulgated by CAC director Zhuang Rongwen (庄荣文) on February 12, 2025, the measures turn a clause that previously existed only in principle into a working compliance cycle. ## Key takeaways - The measures (办法) have been in force since May 1, 2025, issued as CAC Order No. 18 (国家互联网信息办公室令 第18号). - Handlers of personal information on more than 10 million individuals must run a compliance audit at least once every two years. - Regulators can order a commissioned audit after a major risk or a breach affecting 1 million people's information, or 100,000 people's sensitive information. - A mandatory appendix, the *Personal Information Protection Compliance Audit Guidelines* (个人信息保护合规审计指引), defines what the audit actually covers. ## From principle to procedure The Personal Information Protection Law and the Network Data Security Management Regulations both hinted at compliance auditing; this order is where the hint becomes procedure. It defines a personal-information protection compliance audit as the supervised activity of reviewing and evaluating whether a handler's processing complies with laws and regulations. Two paths exist. A handler may audit itself, using an internal team or a commissioned professional body, on a self-set schedule. But the law-built trigger is the floor: any handler above the 10-million-person mark must audit at least biennially regardless of whether a regulator knocks. Below that line, the obligation is risk-driven rather than calendar-driven. ## When the regulator pulls the lever The order gives authorities — the CAC and other personal-information protection duty-holders — the power to demand a commissioned audit in three situations: when processing shows a serious risk to individuals' rights or a clear lack of security measures; when processing may harm the rights of many individuals; and when a security incident exposes, tampers with, loses, or destroys the personal information of more than 1 million people, or the sensitive personal information of more than 100,000 people. Two guardrails matter. The same incident or risk cannot be used to demand repeat audits, and the handler — not the audited party's counterpart — bears the cost when a regulator orders the work. The handler must also give the professional body the access it needs, finish within the set window, submit the report, and remediate. ## What the audit actually examines The appendix guidelines are the substance. They distill the key points of the Personal Information Protection Law and related rules into an audit lens: whether processing has a lawful basis, whether consent was valid, how sensitive information is handled, how minors' data is protected, how cross-border transfers are justified, and whether individuals can exercise their rights to access, copy, correct, or delete. For an AI product, that list is not abstract. Training-data sourcing, model fine-tuning on user inputs, retention of conversation logs, and overseas model-hosting all fall under the same audit spotlight as a traditional database. ## Who may perform the audit The order sets gatekeeping for professional bodies. A qualified institution needs the capacity to do the work — auditors, premises, facilities, and funding — and is encouraged to seek certification under the certification regulations. It must act with integrity and impartiality, keep confidential any personal information, trade secrets, or confidential business information it sees, and it may not sub-delegate the audit to another body. One detail prevents capture: the same institution and its affiliates, and the same lead auditor, may not audit the same object more than three times in a row (连续三次以上). The rotation rule is a quiet but important anti-capture mechanism. ## Honest limitations The measures prescribe rhythm and scope but not depth. A handler can satisfy the letter by commissioning an audit that checks boxes without surfacing systemic risk, and the order gives regulators oversight rather than guaranteeing uniform rigor across provinces. The 10-million threshold also creates a cliff: a firm at 9.9 million people escapes the biennial duty entirely, which can incentive threshold management rather than genuine protection. Enforcement still leans on the penalty provisions of the underlying laws, so the order's real force depends on how actively the CAC and local bodies police non-compliance and demand triggered audits after incidents. ## What readers can do now - If your service holds personal information on more than 10 million people, lock a biennial audit cadence into your compliance calendar now rather than waiting for a regulator's demand. - If you handle sensitive categories or minors' data, pre-align your internal controls with the appendix guidelines so a triggered audit is a formality, not a fire drill. - If you select an audit firm, confirm its independence and the three-times rotation rule before signing, since a tainted audit can be rejected and re-ordered at your cost. --- Published by NeuroAI (https://neuroai.site/) — https://neuroai.site/a/na-personal-info-compliance-audit-rules Free to quote with attribution and a link to the original.