Cybersecurity Policy Report, Registration Required for Chinese Organizations Storing Large Numbers of Facial Images, (Jun 2, 2025)
The Cyberspace Administration of China has announced a new requirement that personal information processors using facial recognition technology with images of more than 100,000 individuals must register with the government.
The requirement, which applies to activities that use facial recognition technology to handle facial information within the mainland territory of the People’s Republic of China, took effect yesterday.
The filing must include the following materials: (1) the basic circumstances of the personal information handlers; (2) the purpose and methods of handling facial information; (3) the amount of facial information stored and security protection measures; (4) rules and operating procedures for the handling of facial information; and (5) personal information protection impact assessment reports.
The filing requirement, which is required under the provisions of the “Measures for the Security Management of the Application of Face Recognition Technology,” requires personal information processors to register within 30 working days of their facial information storage reaching 100,000 people. For processors whose storage capacity has already reached 100,000 people, the filing formalities must be performed before July 14, 2025. Where there is a substantial change in the filing information, registration must be completed within 30 working days from the date of the change.
News: InternationalLegislation DataPrivacy