PIPL Compliance Audit Measures take effect 1 May 2025 (CAC)

On 14 February 2025, the Cyberspace Administration of China published a notice that the 个人信息保护合规审计管理办法 (Personal Information Protection Compliance Audit Measures) would take effect on 1 May 2025. The page we opened on 20 September 2026 summarises the measures’ two audit tracks, frequency rules and professional-institution duties.

What CAC states on this page

Self-initiated audits: processors must periodically audit compliance with laws and administrative regulations via an internal unit or a professional institution. Processors that handle personal information of more than 10 million individuals must conduct a personal-information protection compliance audit at least once every two years.

Regulator-required audits: where a personal-information protection authority finds large risk, possible mass rights harm, or a personal-information security incident, it may require the processor to commission a professional institution.

Professional institutions must have suitable capability, stay independent (no continuous three-times-plus audits of the same object by the same institution/affiliates/lead auditor), keep confidentiality, and must not subcontract the audit. An annexed 合规审计指引 is referenced as the checklist processors and institutions should follow.

What this notice is not

This CAC page is an official announcement of the measures’ publication and effective date. It is not a completed audit report for any named game or adtech vendor, not a list of certified auditors, and not a statement that every China UA vendor already filed an audit.

Operator action

Download the measures card. Cross-check the later DPO information filing notice for the >1 million registration track.

Research checked 20 September 2026. Local draft; human editorial review pending.