China Personal Information Protection Compliance Audits: Measures Effective May 2025

Since 1 May 2025, every personal information handler in mainland China has had to audit its own compliance with the Personal Information Protection Law (PIPL) on a regular cycle, and the regulator can now order an external audit at the handler's cost. The Measures for the Administration of Personal Information Protection Compliance Audits (个人信息保护合规审计管理办法), CAC Order No. 18, turned two short PIPL articles into a working regime: who must audit, how often, when a regulator can order a third-party audit, what the auditor must check, and how quickly findings must be fixed. This guide covers the triggers, the 27-item audit guideline annexed to the Measures, auditor selection and rotation, enforcement, and how to build audit evidence for automated systems and the machine identities that process personal data. It is for privacy, compliance and security leads at organisations with operations or users in China. For the PIPL itself (legal bases, transfers, rights) read the China PIPL Guide; this page does not repeat it. Status: summarised from the CAC's published text and expert commentary, checked 8 November 2026. English renderings of Chinese terms are our own. Article thresholds, dates and PIPL Article 66 fines were checked against the CAC and NPC texts. Confirm every obligation, deadline and penalty against the official text before relying on it.

Key takeaways

• Two audit routes: routine self-initiated audits by an internal unit or an outside professional firm (Article 3), and regulator-ordered audits by a professional firm when risk or an incident warrants it (Article 5).
• 10 million is the hard cycle: a handler processing the personal information of more than 10 million people must audit at least once every two years (Article 4); everyone else audits "periodically" at a frequency they must justify.
• Incident thresholds can trigger an ordered audit: a security incident affecting more than 1 million people, or the sensitive personal information of more than 100,000 people, is one of three grounds for a regulator to require an external audit.
• Fix and report in 15 working days: after an ordered audit the handler must rectify as directed and submit a rectification report within 15 working days of completing rectification (Article 11).
• Auditor independence is regulated: no subcontracting, confidentiality and deletion of audit data, and no more than three consecutive audits of the same handler by the same firm, its affiliates or the same lead auditor.

Scope: who and what is covered

The Measures implement PIPL Article 54, which requires handlers to "regularly conduct compliance audits" of their processing, and Article 64, which lets regulators require an audit by a professional institution when they find high risk or an incident. They also implement the audit provisions of the Network Data Security Management Regulations. Article 2 applies the Measures to compliance audits of personal information processing carried out within the territory of the People's Republic of China, and defines a compliance audit as a supervisory review of whether a handler's processing complies with laws and administrative regulations. Article 19 excludes state organs and organisations authorised by law to manage public affairs.

The "protection departments" (保护职责的部门) are the CAC and the other departments with personal information protection duties under the PIPL, so a sector regulator can order an audit as well as the CAC. Neither the Measures nor the CAC commentary defines how the 10 million and 1 million counts are measured (annual, cumulative or unique individuals). Our recommendation: count unique natural persons whose personal information you hold or process in China across all systems, document the method, and apply the stricter reading if you are near a threshold.

Key obligations

Self-initiated audits

Article 3 lets a handler use its own internal audit function or a professional firm. The Measures do not require self-initiated audit reports to be filed with a regulator; filing applies to ordered audits. The report still matters: it is the evidence a regulator will ask for after an incident, and Article 6 requires every audit, self-initiated or ordered, to follow the annexed Personal Information Protection Compliance Audit Guidelines (个人信息保护合规审计指引).

Regulator-ordered audits

Article 5 lists three grounds on which a protection department may require a handler to commission a professional firm:

1. processing poses serious risks to individual rights and interests, or security measures are seriously inadequate;
2. processing may infringe the rights and interests of a large number of individuals;
3. a personal information security incident causes the leak, tampering, loss or damage of the personal information of more than 1 million people, or the sensitive personal information of more than 100,000 people.

The same incident or risk cannot be the basis for repeated audit demands. Once ordered, the handler selects a firm as the department directs (Article 9), supports the audit and bears its cost (Article 8), completes it within the time limit set (extensions need approval in complex cases), and submits a report signed by the firm's principal and lead auditor and sealed by the firm (Article 10). The Measures do not fix a number of days for the audit itself: the department sets it case by case.

What the audit must cover: the 27-item guideline

The annex is the practical heart of the Measures. It restates PIPL duties as audit items. The table groups them by the evidence an auditor will request.

Item 20 is where security teams carry the load: measures proportionate to scale and type, confidentiality, integrity and availability, encryption and de-identification, and access control. Item 19 includes access permission management and data classification. These are the items where non-human identities appear in the evidence.

Auditor selection and independence

• Capability: the firm must have auditors, premises, facilities and funds suited to the work; certification under the Certification and Accreditation Regulations is encouraged (Article 7), not required.
• Conduct: act lawfully, honestly and objectively, keep personal information, trade secrets and confidential business information confidential, and delete it promptly after the audit (Article 13).
• No subcontracting: the engaged firm may not pass the audit to another institution (Article 14).
• Rotation: the same firm, its affiliates or the same lead auditor may not audit the same target more than three consecutive times (Article 15). Track this in your audit calendar now, because a long-standing provider will hit the limit.

Timeline and current status

As of November 2026 the Measures are in force as published. The Measures do not state when the first two-year cycle for handlers above 10 million ends; our reading is that a handler above the threshold should have completed a first audit within two years of 1 May 2025, and planning for a completed report by then is the cautious course. Check the CAC policy pages for any later implementing guidance or standards before your next cycle.

Enforcement and penalties

Article 18 sends violations to the PIPL and related laws, with criminal liability where a crime is committed. Article 17 lets any organisation or individual report unlawful audit conduct to a protection department. The PIPL penalty tiers apply:

Under PIPL Article 64 a regulator can also interview the handler's legal representative or principal manager. In practice, a failed or missing audit is most likely to surface after an incident above the Article 5 thresholds, when the regulator asks for the last self-audit and then orders an external one. Pair this guide with the China Cybersecurity Incident Reporting Measures Guide, because the same incident starts both clocks.

What it means for AI agents and non-human identities

An auditor testing items 19 and 20 asks who and what can reach personal information. In most estates the majority of those principals are not people: service accounts that run ETL jobs, API keys held by CRM and marketing integrations, OAuth grants to SaaS tools, CI/CD tokens that deploy to production databases, and increasingly AI agents that read customer records to answer tickets. Each is an access path the audit must account for.

• Inventory: list every non-human identity with read or write access to personal information stores in China, with an owner and a purpose. The NHI Discovery Guide covers the method.
• Purpose limitation for machines: item 3 asks whether processing is purpose-linked and minimal. A reporting service account with full table access fails that test even if no person ever misuses it. Scope machine credentials to the fields and records the job needs.
• Entrusted processing: item 6 requires supervision of processors. An API key issued to a vendor is the technical form of that entrustment; it should expire with the contract and be logged.
• Automated decision-making: item 9 applies directly to AI agents and models that make decisions with significant impact on individuals. Keep decision logs, a documented opt-out path and an impact assessment per use case.
• Cross-border paths: item 15 counts transfers. An agent or integration that calls an offshore model endpoint with personal data is a transfer; include it in the volume count.
• Evidence quality: auditors trust logs that tie each action to a named identity. Shared or anonymous machine credentials make that impossible. See Audit Readiness for AI Agents and NHIs.

Compliance steps

1. Count and classify (weeks 1 to 4): establish whether you exceed 1 million or 10 million individuals, document the counting method, and confirm whether you hold sensitive personal information of more than 100,000 people, since that sets your incident exposure under Article 5.
2. Appoint and empower: if at or above 1 million, appoint the protection officer with authority over audit work (Article 12); large platforms set up the external oversight body.
3. Map evidence to the 27 items: build an evidence register keyed to the guideline items, with an owner per item. Start with items 15, 19, 20 and 23, which usually have the largest gaps.
4. Choose the auditor model: internal audit for routine cycles if it is independent of the processing teams; an external firm for the first cycle above 10 million and for any ordered audit. Record firm, affiliates and lead auditor to manage the three-consecutive rotation limit.
5. Run a dry audit: test a sample of items end to end, including a pull of machine identity access to one personal data store, and fix findings before the formal audit.
6. Run the formal audit and remediate: track every finding to closure. For an ordered audit, plan the 15 working day rectification report into the remediation schedule.
7. Prepare an ordered-audit runbook: who receives the notice, how a firm is engaged quickly, who provides data access to auditors under confidentiality, and how audit data is deleted afterwards.
8. Repeat on cycle: two years at most above 10 million; for others, our recommendation is annually or after any significant change in processing.

Common failure patterns

• No counting method: the organisation cannot show whether it is above 10 million, so it cannot show whether its cycle is compliant.
• Treating the audit as a privacy notice review: items 19 and 20 require technical evidence on access control, encryption and logging; legal-only audits miss them.
• Machine access left out of scope: access reviews cover employees but not service accounts, API keys and agents, which hold the broadest standing access to personal data.
• Same auditor forever: a fourth consecutive engagement of the same firm or lead auditor breaches Article 15.
• No ordered-audit plan: after a large incident the handler loses days choosing a firm and granting data access while the regulator's time limit runs.

Practitioner checklist

• Document the method and result of your 1 million and 10 million individual counts.
• Appoint a protection officer with audit responsibility if at or above 1 million.
• Build an evidence register mapped to all 27 guideline items with named owners.
• Include every service account, API key, OAuth grant and AI agent with access to personal data in the audit scope.
• Record the auditor firm, affiliates and lead auditor per cycle to manage rotation.
• Schedule the next audit date, no later than two years after the last one above 10 million.
• Keep an ordered-audit runbook with a pre-qualified firm and a confidentiality and deletion clause.
• Plan the 15 working day rectification report into remediation timelines.

Standards and references

• Cyberspace Administration of China: Measures for the Administration of Personal Information Protection Compliance Audits (Order No. 18) and annexed Guidelines
• Cyberspace Administration of China: Release announcing the compliance audit Measures
• Cyberspace Administration of China: Expert commentary on the compliance audit Measures
• National People's Congress: Personal Information Protection Law (English, Articles 52 to 74)
• China Law Translate: Personal Information Protection Compliance Audit Measures (English translation)
• NIST: Cybersecurity Framework 2.0

This guide summarises the Measures for the Administration of Personal Information Protection Compliance Audits and is not legal advice. Related NHI Mgmt Group resources: China PIPL Guide · China Data Security Law and Network Data Security Regulations Guide · DPIA Guide: Running a Data Protection Impact Assessment · NHI Ownership Guide