Cybersecurity Policy Report, Q&As on Personal Information Protection Released in China, (May 1, 2026)

By Tony Foley

The Cyberspace Administration of China (CAC) released a series of questions and answers earlier this week designed to strengthen the publicity and implementation of polices and regulations related to personal information protection.

In the Q&A document, CAC outlines how to determine the number of people whose personal data is being processed by network data processors to determine whether they are subject to provisions of the Regulations on the Management of Network Data Security and the measures for the Audit of Personal Information Protection Compliance, among other laws, noting that, in general, in determining whether the relevant thresholds are met, data subjects are counted based on the number of natural persons involved in the current processing of personal information by the processor, but the number does not include deleted personal information.

CAC also addresses how often personal information processors must conduct personal information protection compliance audits, specifying that the law requires such an audit every two, three, or five years, depending on the number of people whose personal information the organization processes. Finally, CAC includes information on the items that must be included in compliance audits for the protection of minors’ personal information as required under article 37 of the Regulations on the Online Protection of Minors.

News: InternationalLegislation DataPrivacy DataSecurity