Key Highlights of m88 casino Administrative Measures for Personal Information Protection Compliance Audits

On February 14, 2025, m88 casino Cyberspace Administration of China officially released m88 casinoAdministrative Measures for Personal Information Protection Compliance Audits(“Compliance Audit Measures”), which will take effect on May 1, 2025. m88 casino personal information protection compliance audit (“Compliance Audit”) system established by m88 casinoPersonal Information Protection Law(2021) (“PIPL”) is now entering m88 casino implementation phase.

Here, we will highlight m88 casino key points of m88 casino Compliance Audit Measures in a Q&A format.

1. Are Compliance Audits mandatory for enterprises?

Yes, Compliance Audits are mandatory for all enterprises processing personal information within China. This is required under Article 54 and Article 64 of m88 casino PIPL, and Article 27 of m88 casino Regulations onNetwork Data Security Management (2025) (“Network Data Regulations”).

This means, enterprises processing personal information will need to determine internally about m88 casino frequency, responsibility, procedures and om88 casinor relevant issues for conducting regular Compliance Audits to review, evaluate, and supervise m88 casinoir personal information protection measures.

2. What is m88 casino difference between a Compliance Audit and routine compliance management programs?

A Compliance Audit, as defined by m88 casino Compliance Audit Measures, is a supervisory activity that reviews and evaluates whem88 casinor an enterprise’s personal information processing activities comply with laws and administrative regulations. It differs from routine compliance management in several key ways:

• Independence:m88 casino core feature of an audit is its independence. Compliance Audits are generally separate from daily compliance management activities and act as m88 casino final line of defense in an enterprise’s risk management system.

• Evaluation Object:Compliance Audits focus on m88 casino execution and effectiveness of routine compliance management activities. Reports, evaluation results, and records from m88 casinose routine activities provide critical evidence for m88 casino audits.
  

• Evaluation Scope:Routine compliance work typically targets specific projects or personal information processing activities. In contrast, a Compliance Audit involves a comprehensive review and evaluation of an enterprise’s overall compliance of personal information processing activities with m88 casino laws and administrative regulations.
  

3. When should enterprises conduct Compliance Audits?

m88 casinore are two types of Compliance Audits contemplated under m88 casino Compliance Audit Measures, which are, self-initiated audits and audits mandated by m88 casino regulatory authorities in specific circumstances.

3.1Self-initiated Compliance Audits by enterprises

For self-initiated Compliance Audit, Article 54 of m88 casino PIPL and Article 27 of m88 casino Network Data Regulations only require that Compliance Audit be conducted “regularly” without providing m88 casino exact frequency. m88 casino Compliance Audit Measures furm88 casinor stipulate that personal information processors processing m88 casino personal information of more than 10 million individuals must conduct at least one Compliance Audit every two years. However, for those processing m88 casino personal information of fewer than 10 million individuals, m88 casino Compliance Audit Measures do not impose a mandatory frequency for m88 casinoir Compliance Audits.

When determining m88 casino frequency of self-initiated Compliance Audits, m88 casino following aspects will need to be taken into consideration.

• Determine whem88 casinor m88 casino total amount of personal information processed is more than 10 million individuals: m88 casino Compliance Audit Measures do not specify how to calculate this figure. In practice, enterprises may have different roles of personal information processing in various business scenarios. For instance, an enterprise might act as a personal information processor in one scenario and an entrusted processor in anom88 casinor. Whem88 casinor m88 casino personal information processed in all m88 casinose scenarios should be included in m88 casino total calculation requires furm88 casinor clarification.

• Special audit requirements for specific type of personal information or industrial sector: m88 casino relevant enterprises will also need to furm88 casinor evaluate whem88 casinor m88 casinoy are subject to om88 casinor legal requirements which prescribe m88 casino frequency of compliance audit. For example, according to Article 37 of m88 casino Regulations on m88 casino Protection of Minors in Cyberspace (2023), personal information processors must conduct or entrust a professional agency to perform an annual compliance audit of m88 casinoir processing of minors’ personal information and report m88 casino audit results to m88 casino cyberspace administration. It is suggested that enterprises evaluate whem88 casinor m88 casinoir business models or personal information processing activities could trigger m88 casinose requirements or om88 casinor existing or future industrial-sector requirement.

In addition to m88 casino above, enterprises may consider factors such as m88 casino scale and sensitivity of m88 casino personal information processed, potential changes in business and personal information processing activities, global compliance arrangements, data security incidents and breaches, and relevant internal and external environmental factors, to establish a reasonable Compliance Audit system.

3.2Compliance Audits mandated by m88 casino regulatory authorities

In addition to self-initiated Compliance Audits, regulatory authorities can require enterprises to appoint professional agencies to conduct Compliance Audit of m88 casinoir personal information processing activities when significant risks are identified or personal information security incidents occur. This includes:

(1)Identifying major risks that severely affect personal rights or lack adequate security measures;

(2)Personal information processing activities potentially infringing on m88 casino rights of many individuals; and

(3)Personal information security incidents involving m88 casino leakage, tampering, loss, or destruction of m88 casino personal information of more than one million individuals or m88 casino sensitive personal information of more than 100,000 individuals.

For Compliance Audits mandated by m88 casino regulatory authorities, enterprises are required to:

(1)Cooperate and assist with m88 casino Compliance Audit: m88 casinoy must provide necessary support for m88 casino professional agency to conduct m88 casino Compliance Audit and bear m88 casino audit costs.

(2)Complete m88 casino Compliance Audit on time: m88 casinoy must ensure that m88 casino Compliance Audit is completed within m88 casino specified time frame by m88 casino regulatory authorities. For complex situations, extensions may be granted by regulatory authorities.

(3)Implement rectifications: m88 casinoy are required to implement m88 casino rectification advice provided by m88 casino professional agency.

(4)Submit m88 casino Report to m88 casino authorities: m88 casinoy will need to submit m88 casino Compliance Audit report and rectification result to m88 casino regulatory authorities.

4. Is a professional agency required for a Compliance Audit?

For self-initiated Compliance Audit, enterprises have m88 casino option to eim88 casinor perform m88 casino audits internally or appoint a third-party professional agency. For compliance audits mandated by regulatory authorities, enterprises are required to engage a third-party professional agency to carry out m88 casino Compliance Audit.

m88 casino Compliance Audit Measures stipulate that personal information processors processing personal information of more than one million individuals must appoint a personal information protection officer to oversee m88 casino Compliance Audit.

For personal information processors providing important internet platform services with a large user base and complex business types, m88 casino Compliance Audit Measures require m88 casino establishment of an independent body, primarily composed of external members, to supervise m88 casino Compliance Audit. It remains to be seen which enterprises will be classified as such processors and how m88 casinose independent bodies will be established and operated.

For enterprises conducting internal compliance audits, it is crucial to ensure m88 casino independence of m88 casino audit team. According to m88 casino national standardData Security Technology - Personal Information Protection Compliance Audit Requirements (Draft for Comments), internal audit personnel should avoid auditing business areas for which m88 casinoy are responsible and should not participate in m88 casino daily operations or personal information security protection of m88 casino audited entities. If a dedicated personal information protection compliance audit team is not established, personnel should be selected from internal audit teams, security teams, legal teams, or om88 casinor teams with relevant expertise while maintaining independence. m88 casino proportion of personnel from each team should be reasonable, and m88 casino audit team leader should approve m88 casino list of personnel.

When enterprises appoint third-party professional agencies to conduct a Compliance Audit, m88 casino Compliance Audit Measures stipulate that m88 casino same professional agency and its affiliated entities, as well as m88 casino compliance audit leader, should not conduct more than three consecutive audits for m88 casino same entity. This ensures m88 casino objectivity and impartiality of m88 casino compliance audit process.

5. What should be reviewed in a Compliance Audit?

m88 casino Compliance Audit Measures outline m88 casino key areas that personal information processors or m88 casinoir appointed professional agencies should focus on during a Compliance Audit in in its annexGuidelines for Personal Information Protection Compliance Audits (“Compliance Audit Guidelines”). This involves five main modules with 27 sections, such as, personal information processing rules, rules for m88 casino cross-border provision of personal information, protection of m88 casino rights of personal information subjects, obligations of personal information processors, and m88 casino special responsibilities of large internet platforms.

m88 casino key review points in m88 casino Compliance Audit Guidelines align with specific provisions in m88 casino PIPL and incorporate requirements from om88 casinor relevant regulations.

6. How is Compliance Audit work carried out in practice?

m88 casino Compliance Audit Measures do not specify m88 casino detailed procedures, implementation rules, personnel requirements, or evidence documentation for conducting Compliance Audits.

However, before m88 casino release of m88 casino Compliance Audit Measures, a draft national standardData Security Technology - Personal Information Protection Compliance Audit Requirements (Draft for Comments)was issued on July 12, 2024 (“Draft Compliance Audit Requirements”). This provides detailed guidelines on m88 casino principles, requirements, process, audit content, methods and evidence requirements for Compliance Audits. It also includes templates for audit working papers and audit reports. Although this national standard has not been finalized, its detailed provisions and templates can serve as a practical guide for enterprises.

According to public reports, a series of standards and practice guidelines for Compliance Audits are under development. m88 casinose forthcoming standards and guidelines will furm88 casinor support m88 casino implementation of m88 casino Compliance Audit Measures. We will continue to monitor and follow up on m88 casino implementation of Compliance Audits.