Key Points of Draft Measures for Personal Information Audit
If the Administration Measures for Personal Information Compliance Audit is adopted as currently drafted, it will apply to all companies processing personal information. The frequency of self-audits will vary based on the amount of personal information processed. Companies processing the personal information of more than one million individuals must conduct a personal information compliance audit (“Compliance Audit”) at least once a year, while others must conduct an audit at least every two years. Under the self-audit scenario, companies may conduct audits on their own or entrust a recognized professional institution approved by cyberspace administration departments. However, the same institution cannot conduct more than three consecutive Compliance Audits for the same company. In cases of high-risk personal information processing activities or personal information security incidents, the department responsible for personal information protection may require the company to entrust a professional institution for the Compliance Audit. The Compliance Audit focuses on the requirements outlined in the Personal Information Protection Law (“PIPL”) and the relevant national standards, covering areas such as personal information processing rules, cross-border data transfers, rights of personal information subjects, obligations of personal information processors, and special responsibilities for large Internet platforms.
On August 3, 2023, the Cyberspace Administration of China released the Administrative Measures for Personal Information Compliance Audit (Draft for Comments) (“Audit Measures”) for public consultation until September 2, 2023. This article analyzes the circumstances in which the Compliance Audit is applicable, the key points to be reviewed in the Compliance Audit, and the legal responsibilities outlined in the Audit Measures. It also provides recommendations for companies acting as personal information processors on how to conduct Compliance Audits in accordance with the laws.
Applicable Circumstances for the Compliance Audit
The Audit Measures have clarified and expanded the requirements for Compliance Audits stated in Articles 54 and 64 of the PIPL. They categorize the triggering circumstances for Compliance Audits into two types: “regular self-audits” and “ad hoc audits required by the regulator”. The latter are required by the supervisory authorities when high risks are identified in personal information processing activities or when a personal information security incident occurs.
According to Article 54 of the PIPL, personal information processors are obligated to conduct Compliance Audits on a regular basis. The Audit Measures further specify that personal information processors processing the personal information of more than one million individuals must conduct a Compliance Audit at least once a year. For other personal information processors, a Compliance Audit is required at least once every two years (Article 4).
Ad hoc Audits Required by the Regulator
Article 64 of the PIPL states that, if a department responsible for personal information protection identifies high risks in personal information processing activities, or if a personal information security incident occurs during their duties, they may require the personal information processor to engage a professional institution to conduct a Compliance Audit of their personal information processing activities.
The Audit Measures also outline requirements for the recommendation and selection of audit institutions. The national cyberspace administration departments, in collaboration with public security and other departments, are responsible for establishing a recommended directory of professional institutions for Compliance Audits. Additionally, professional institutions conducting Compliance Audits should maintain independence and objectivity and not conduct more than three consecutive Compliance Audits for the same company.
Specific Requirements on Ad hoc Audits Required by the Regulator
The Audit Measures outline the obligations of personal information processors under these circumstances:
Selection of the institution (Article 7 and 13 of the Audit Measures)：Personal information processors are advised to consult the recommended directory of professional institutions for Compliance Audits. They should then engage a third-party professional institution to conduct the audit. Assisting and cooperating (Article 8 of the Audit Measures)：Personal information processors must assist and cooperate with professional institutions during Compliance Audits. This includes providing or facilitating access to relevant documents and information and allow access to locations associated with personal information processing, examining and testing business activities, information systems, and related equipment and facilities. They should provide or facilitate access to retrieve and access data or information relevant to personal information processing, conduct interviews with individuals involved in personal information processing and cooperate with investigations, inquiries, and evidence-gathering activities carried out by professional institutions. Timely completion (Article 9 of the Audit Measures)：Generally, ad hoc audits required by the regulator should be completed within 90 working days. Reasonable extensions may be granted for complex cases. Rectification actions (Article 10 and 11 of the Audit Measures)：Personal information processors should implement recommended rectifications as proposed and reviewed by professional institutions. Reporting the outcome (Article 10 and 11 of the Audit Measures)：The Compliance Audit report issued by professional institutions and the status of rectification should be reported to the department responsible for personal information protection.
Key Review Points of the Compliance Audit
The Audit Measures outline the specific matters to be examined during the Compliance Audit, either by the personal information processor or the professional institution entrusted by the processor. These examination points are detailed in the Appendix Reference Points for Compliance Audit of Personal Information Protection (“Reference Points”), aligning with the provisions of each chapter of the PIPL. The Reference Points incorporate requirements from administrative regulations and national standards, such as the Information Security Technology - Personal Information Security Specification. They comprehensively cover the entire process of personal information processing and can be categorized into the following five modules:
Personal information processing rules (Article 2 to 13 of the Reference Points)：In accordance with Chapter 2 of the PIPL, the Reference Points provide key points for the Compliance Audit, such as the legal basis of personal information processing, processing rules, notifications, joint processing, entrusted processing, processing during merger/division/dissolution/bankruptcy, personal information provision, automated decision-making, disclosure, collection from public places, processing personal information that has already been disclosed, sensitive personal information processing, and processing the personal information of minors, etc. Cross-border provision of personal information (Article 15 and 16 of the Reference Points)：In accordance with Chapter 3 of the PIPL, the Reference Points provide key points for the Compliance Audit, such as the compliance routes for cross-border transfers of personal information, cross-border transfers based on judicial enforcement or treaty agreements, and measures taken to ensure that overseas recipients’ processing meets PIPL requirements, etc. Protection of rights of personal information subjects (Article 17 to 19 of the Reference Points): In accordance with Chapter 4 of the PIPL, the Reference Points provide key points for the Compliance Audit, such as the acceptance of requests regarding the rights of personal information subjects, and the protection of rights to access, copy, transfer, correct, supplement, delete, and request an explanation of the rules of personal information processing, etc. Obligations of personal information processors (Article 20 to 27 of the Reference Points)：In accordance with Chapter 5 of the PIPL, the Reference Points provide key points for the Compliance Audit, such as the responsibilities of personal information processors, management measures, technical measures, personnel training, person in charge of personal information protection, personal information protection impact assessment, and personal information security incident response, etc. Special responsibilities for large Internet platforms(Article 28 to 31 of the Reference Points)：In accordance with Article 58 of the PIPL, the Reference Points provide key points for Compliance Audits, such as the independent organizations overseeing personal information protection, internet platform rules, supervision of product or service providers within the platform, and social responsibility reporting on personal information protection.
Article 1 of the Reference Points clarifies that their purpose is to provide guidance for conducting Compliance Audits. Therefore, it is understood that companies and professional institutions may make adjustments and additions to the Reference Points based on their specific circumstances.
Legal Liabilities for Violating the Audit Measures
Article 15 of the Audit Measures serves as a transitional provision, stating that penalties for non-compliance by personal information processors are subject to the relevant provisions of the PIPL. According to Chapter 7 of the PIPL, a personal information processor that fails to fulfill its obligations related to Compliance Audits may face the following penalties imposed by the department responsible for personal information protection: ordering corrections, issuing warnings, confiscating the illegal gains, and ordering the suspension or termination of those who process personal information in violation of the law. If a personal information processor refuses to rectify their non-compliance, they may be fined up to 1 million RMB. In cases of serious violation, departments responsible for personal information protection at or above the provincial level may impose fines of up to 50 million RMB or 5% of the previous year’s turnover and may order the suspension of the relevant business operations and revoke the relevant business permit or license through notification to the relevant competent authority. Furthermore, individuals directly responsible and other directly liable persons may face fines ranging from 10,000 RMB to 100,000 RMB if they refuse to rectify non-compliance. In serious violations, they may be fined from 100,000 RMB to 1 million RMB. Additionally, they may be prohibited from holding positions such as director, supervisor, senior manager, or person in charge of personal information protection within related companies for a specified period of time.
The release of the Draft for Comments version of the Audit Measures reflects the ongoing trend of strengthening legislation and supervision surrounding personal information protection in China. It highlights the importance of conducting Compliance Audits for personal information processors and provides specific requirements and methods for conducting such audits. Additionally, we understand that the reports and record files generated by companies upon completion of Compliance Audits may serve as evidence of compliance. This can be beneficial in demonstrating adherence to the legal requirements, regulations, and standards related to personal information protection and data security during government investigations, law enforcement actions, and Compliance Audits conducted by government agencies, relevant organizations, or business partners. Although the official version of the Audit Measures may take some time to be released, it is advisable that companies promptly establish an internal mechanism for conducting Compliance Audits. This should be done in accordance with the requirements outlined in the Draft for Comments version of the Audit Measures and should be tailored to the specific characteristics of their own business and management. By doing so, companies can proactively prepare for Compliance Audits to be conducted once the Audit Measures are formally implemented. This preparation should include considerations for management, staffing, technical support, and external cooperation, among other relevant factors.
Marissa Dong
Partner dongx@junhe.com Corporate and M&A Telecom and Internet Data Privacy, Cybersecurity and Information Law Jinghe Guo Associate guojh@junhe.com * Intern Yiru Zhan also contributed to this article 欢迎订阅《君合数据保护和网络安全月报》，如需订阅本月报及君合其他业务组月报请扫描下方“二维码”填写订阅表单，以便我们将相关月报及时发送给您。
“碳中和专项基金”是君合律师事务所与北京绿化基金会共同发起的公益项目。
Click "Read more" to Visit JunHe Official Website
Disclaimer Articles published on JUNHE Legal Updates represent only the opinions of the authors and should not in any way be considered as formal legal opinions or advice given by JunHe or its lawyers. If any part of these articles is reproduced or quoted, please indicate the source.Any picture or image contained in these articles MUST not be reproduced or used unless otherwise consented by us in writing. You are welcome to contact us for any further discussion or exchange of views on the relevant topic. |
韩国济州岛君悦酒店2~4晚套餐含接机+免税店金卡+不进店 飞猪旅行
韩国济州岛 济州君悦酒店Grand Hyatt Jeju /1-4晚酒店套餐
韩国济州岛君悦酒店单订房1-4晚酒店套餐纯玩不进免税店飞猪旅游
【周末不加价】韩国济州岛君悦酒店1-4晚套餐+接机+免税店金卡
DJ酒店Ya金专拍链接8.3-5长沙君悦酒店
全实木欧式床真皮奢华双人美式别墅主卧床高端大气1米8床广东佛山
发表于 2023-8-9 18:00:56
