What are the China PI Compliance Audit Measures compliance deadlines?

May 1, 2025: PI compliance audit measures take effect.

When does China PI Compliance Audit Measures take effect?

China PI Compliance Audit Measures took effect on May 1, 2025.

Who does China PI Compliance Audit Measures apply to?

All personal information processors in China; mandatory biennial audits for processors handling PI of more than 10 million individuals. The related CAC Q&A ties the DPO requirement to processors handling PI of 1 million+ individuals.

What are the penalties under China PI Compliance Audit Measures?

Penalties are imposed under the PIPL (up to RMB 50 million or 5% of prior-year turnover for serious violations).

China PI Compliance Audit Measures

In force China · In force May 1, 2025 · no upcoming deadlines

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Takes effectMay 1, 2025 · 18 months ago · Source

PI compliance audit measures take effectSelf-audit and regulator-ordered audit regime applies; 10M+ processors must audit at least every two years.

Summaries for reference, not legal advice. Check the official text.

What it does

Implements PIPL Arts. 54 and 64: PI processors must audit their own PIPL compliance regularly, and regulators can order an audit by a professional firm when they find high risk or an incident. Processors of PI of more than 10 million people must audit at least once every two years.

Who it applies to: All personal information processors in China; mandatory biennial audits for processors handling PI of more than 10 million individuals. The related CAC Q&A ties the DPO requirement to processors handling PI of 1 million+ individuals.
Penalties: Penalties are imposed under the PIPL (up to RMB 50 million or 5% of prior-year turnover for serious violations).
Enforced by: CAC and departments with PI protection duties
Official name: Administrative Measures for Personal Information Protection Compliance Audits (CAC Order No. 18)
Citation: CAC Order No. 18
Topics: Privacy

Verified 2026-09-22 cac.gov.cn

Research notes

The measures fix no calendar date for the first biennial audit. The 1-million DPO threshold comes from the CAC announcement and law-firm summaries, not re-read in the official text here.

AmendedAustralia

Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days

In forceChina

China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025

In forceChina

China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022

In forceChina

China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026

In forceChina

China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024

In forceChina

China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025

AmendedChina

China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017

In forceChina

China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022

Questions about China PI Compliance Audit Measures

What are the China PI Compliance Audit Measures compliance deadlines?: May 1, 2025: PI compliance audit measures take effect.
When does China PI Compliance Audit Measures take effect?: China PI Compliance Audit Measures took effect on May 1, 2025.
Who does China PI Compliance Audit Measures apply to?: All personal information processors in China; mandatory biennial audits for processors handling PI of more than 10 million individuals. The related CAC Q&A ties the DPO requirement to processors handling PI of 1 million+ individuals.
What are the penalties under China PI Compliance Audit Measures?: Penalties are imposed under the PIPL (up to RMB 50 million or 5% of prior-year turnover for serious violations).

Deadlines

What it does

Related