China Is About to Beef Up Personal Data Protection Audits

Data protection audits are measures widely recognised by international regulators to ensure that businesses comply with personal data protection regimes. China’s Personal Information Protection Law (PIPL) also requires data controllers to periodically audit their compliance with laws and regulations concerning the processing of personal data. However, when the law was enacted in 2021, this provision was not accompanied by any implementation rules, rendering it temporarily dormant.

This situation is now being reversed by the latest rule-making efforts. In particular, on 12 July 2024, China’s National Information Security Standardisation Technical Committee released the draft version of a recommended national standard: the Data Security Technology - Personal Information Protection Compliance Audit Requirements (the “Draft National Standard”), which aims to provide practical guidance at the national level on how such audits should be conducted.

The Draft National Standard views personal data protection audits as a formal, independent supervisory activity. It differs from, and is not intended to replace, a company’s general risk assessment and risk monitoring concerning personal data protection. It serves as a thorough wellness check on the robustness of the company’s data protection programme as implemented, focusing on identifying deviations from legal requirements.

While the Draft National Standard considers useful content from mature international data protection audit rules, such as those of the European Data Protection Supervisor (EDPS), the UK’s Information Commissioner's Office (ICO), and France’s Commission nationale de l'informatique et des libertés (CNIL), there is a fundamental difference: these international rules are intended to provide guidance on audits conducted by regulatory authorities, but the Draft National Standard’s audience is data controllers and third-party auditors, because under the PIPL, the duty to carry out the audits remains with the controllers.

To this end, the Draft National Standard sets forth more detailed and comprehensive rules on the principles, procedures, items, methodologies and evidence of such audits, and the requirements and authority of the auditors. Notably, it includes a detailed appendix associating audited items with the recommended methodologies and evidence.

The board of directors (including the audit committee), the data protection officer, or the principal of the company is obliged to establish and maintain the audit mechanisms and holds ultimate responsibility for the independence and effectiveness of such audit mechanisms.

When determining the composition of the specific team for each audit, the company should consider multiple factors, including the size and nature of the business; the volume, categories and sensitivity of the personal data; and the complexity of the internal systems involved. If the company has a dedicated personal data protection audit group, team members should generally be selected from the group. Where there is no dedicated group, team members should be selected from the internal audit team, the security team, the legal team, and other teams with audit or data capabilities. A cross-departmental team is preferred as it is better placed to maintain its independence. The company may also engage a third-party professional institution to carry out the audit.

The Draft National Standard breaks down a typical audit into the following stages: planning, preparation, implementation, reporting, rectification, and archival, and provides detailed guidance on each stage.

The collection and analysis of evidence are key parts of the audit. All audit findings must be substantiated by evidence (or the lack thereof). The Draft National Standard imposes various requirements for the validity of different types of evidence, as summarised in the table below.

As the Draft National Standard will be finalised soon, the obliged data controllers need to start preparing for such audits. These controllers should familiarise themselves with the detailed requirements in the standard, and build the capabilities not only to conduct the audits, but also to pass them. Notably, as such audits are highly reliant on evidence, controllers are advised to maintain detailed written records evidencing their implementation of compliance programmes, as part of their day-to-day operations.