Direct answer: First separate "must audit" from "must commission". A personal-information handler processing more than 10 million individuals' personal information should conduct a compliance audit at least every two years; other handlers should set a reasonable regular frequency; a regulator may require a professional firm only when it finds significant risk, possible harm to many individuals, or an incident reaching the statutory thresholds. Most companies should start with a data map and self-audit—not buy an "audit report" first.
This report is for owners, legal/privacy, IT/security, marketing, sales/CRM, HR and procurement at companies with a corporate website, inquiry forms, cookie analytics, CRM, recruitment pages or AI customer service. It explains how to prepare a PIPL compliance audit in 2026. Information is current to 30 October 2026. It is public law, national standards and project method, not legal advice, an audit conclusion or a regulator's interpretation; applicability, scope, reporting and remediation are governed by the law, authorities and counsel/professional advisers.
A compliance audit is a supervisory activity, not MLPS, ISO 27001 or a "privacy certificate". Self-audit may be internal or voluntarily commissioned; only a regulator-required audit must use a professional firm. Website forms, cookies, AI customer service and CRM are evidence sites—not just a privacy-policy edit.
What is the legal basis for a PIPL compliance audit in 2026?
The Personal Information Protection Compliance Audit Measures took effect on 1 May 2025, detailing audit scenarios, frequency, professional-firm duties and audit guidelines. Companies should prepare under the current rules in 2026.
Compliance auditing is not a new concept. Article 54 of the Personal Information Protection Law (PIPL) requires personal-information handlers to regularly audit their processing against laws and administrative regulations; Article 64 allows a regulator, on finding significant risk or a security incident, to require an audit by a professional firm. Article 27 of the Network Data Security Regulations again requires network data handlers to conduct audits regularly, internally or through a professional firm. On 14 February 2025, CAC published the Personal Information Protection Compliance Audit Measures, effective 1 May 2025, detailing who audits, how often, how to select a firm, and how to report and remediate.
| Date | Rule/event | What it means for companies |
|---|---|---|
| 1 Nov 2021 | PIPL effective; Article 54 requires regular compliance audits, Article 64 allows regulator-required professional audits. | Statutory basis for audit duties |
| 1 Jan 2025 | Network Data Security Regulations effective; Article 27 requires network data handlers to audit regularly, internally or through a firm. | Audit integrated into network-data duties |
| 14 Feb 2025 | CAC publishes the Personal Information Protection Compliance Audit Measures. | Clarifies frequency, firms, reporting and remediation |
| 1 May 2025 | Measures take effect. | Prepare under the current rules in 2026 |
| 30 Oct 2026 | Information cutoff for this report | Check later guidance and local enforcement separately |
Timeline based on PIPL, the Network Data Security Regulations and CAC's published text; the latest official text governs.
Who must audit: 10 million people, regular self-audit and regulator triggers
More than 10 million individuals: at least every two years. Other handlers: a reasonable frequency. Significant risk, harm to many individuals or incident thresholds may lead a regulator to require a professional firm.
The Measures separate two situations: a handler's own audit, which may be performed by an internal body or a commissioned professional firm; and a regulator-required audit, which must use a professional firm. A handler processing more than 10 million individuals' personal information should conduct an audit at least every two years; other handlers should determine a reasonable frequency. A regulator may require a professional audit where it finds significant risk—such as serious impact on individual rights or serious lack of security measures—possible harm to many individuals, or a personal-information security incident causing leakage, alteration, loss or destruction of personal information of more than 1 million individuals or sensitive personal information of more than 100,000 individuals. Do not equate "10 million" with website visits or social followers; the test is the number of individuals whose personal information is processed, and the counting method should be confirmed with counsel/authorities.
| Situation | Trigger | Who audits | Frequency/output |
|---|---|---|---|
| More than 10 million individuals | Processing personal information of more than 10 million individuals | Self-audit; internal or commissioned | At least every two years; report/remediation record |
| Other handlers | Not more than 10 million individuals | Self-audit; internal or commissioned | Reasonable frequency; report/remediation record |
| Regulator—significant risk | Serious impact on individual rights or serious lack of security measures | Professional firm required | Complete and report within the regulator's deadline |
| Regulator—harm to many | Processing may harm many individuals' rights | Professional firm required | Complete and report within the regulator's deadline |
| Regulator—incident threshold | Leakage etc. of 1 million+ individuals' personal information or 100,000+ sensitive personal information | Professional firm required | Complete, remediate and report within the deadline |
| More than 1 million individuals | Processing personal information of more than 1 million individuals | Designate a personal-information protection officer | Responsible for audit work; organisation/duty evidence |
| Large platform | Important online platform, huge user base, complex business | Independent supervisory body with external members | Supervise audit; independent-body record |
Applicability and counting are editorial, not a legal determination; “10 million” refers to individuals whose personal information is processed, not website visits, and should be confirmed with authorities/counsel.
What does the audit cover: website, forms, CRM and AI customer service
Use the audit guidelines to check legal basis, notices/rules, entrusted/joint processing, automated decisions, sensitive information, cross-border transfer, rights requests and incidents. The website is an evidence entry point, not the whole audit.
The annex to the Measures, the Personal Information Protection Compliance Audit Guidelines, breaks laws and regulations into audit items: legal basis, processing rules, notice, joint processing, entrusted processing, transfer, provision to third parties, automated decision-making, publicly available personal information, sensitive personal information, minors, cross-border transfer, rights response and security incidents. A company does not need to audit every department, but it must map real processing scenarios—website, forms, CRM, AI customer service—to these items and keep evidence that can be reproduced.
| Audit dimension | What to check | Website/business touchpoint | Evidence |
|---|---|---|---|
| Legal basis/consent | Consent voluntary, specific, informed; re-consent on change; separate/written consent where required | Inquiry forms, cookies, marketing subscription, recruitment | Consent text, checkbox/log, version record |
| Rules/notice | Identity/contact, list, purpose, retention, rights route | Privacy policy, product pages, form notes | Page version, screenshot, publication record |
| Entrusted/joint processing | Contract purpose/term/method/type/measures; supervision of processor | CRM, cloud, AI customer service, website vendor | DPA/contract, review record |
| Provision/public/transfer | Separate consent, recipient notice, impact assessment; transfer notice | Customer cases, channel sharing, M&A | Authorisation, assessment, notice record |
| Automated decisions/AI | Transparency/fairness, notice, impact assessment, opt-out | AI customer service, marketing recommendations, scoring | Settings, assessment, human takeover |
| Sensitive/minors | Separate consent, necessity, impact assessment, special rules | Recruitment health data, products for minors | Consent, assessment, rules |
| Cross-border | Security assessment/standard contract/certification; notice/separate consent | Overseas CRM, email, AI models | Data map, contract/assessment |
| Rights/incident/security | Access/copy/delete/withdraw; incident reporting; security measures | Accounts, forms, support tickets | Tickets, logs, plan/drill |
Audit dimensions follow the Guidelines; specific procedures, sampling and conclusions should be determined by the company/professional firm under applicable rules.
Self-audit or professional firm: how to choose?
Self-audit fits teams with clear scope, complete evidence and an internal owner; a professional firm fits regulator requirements, high-risk, cross-border/sensitive or low-independence situations. Both use the same guidelines.
The Measures do not require every company to commission a professional firm. A self-audit may be performed internally or voluntarily commissioned; only a regulator-required audit must use a professional firm, select it as required, complete within the deadline, and report the report and remediation. Commissioning is not a "pass guarantee": the firm must be independent, must not subcontract, and the same firm/lead auditor may not conduct more than three consecutive audits for the same subject. The company remains responsible for data, evidence and remediation.
| Dimension | Self-audit | Professional firm | How to choose |
|---|---|---|---|
| Trigger | Regular audit; under 10 million can set its own frequency | Required by regulator; may also be voluntary | Check whether a regulator has required it |
| Cost structure | Internal time, tools, sampling | External fee + internal cooperation | Compare scope/sampling, not price alone |
| Independence | Internal body may be influenced by business | Relatively independent | Use external for high-risk/cross-functional |
| Evidence depth | Knows systems, may lack audit method | Audit method and sampling experience | Check coverage against guidelines |
| Report use | Internal remediation/board/customer audit | Regulator reporting/remediation | Choose by purpose |
| Restrictions | Needs owner and independence safeguards | No subcontracting; three-consecutive limit | Write into contract |
| Best fit | Clear scope, complete data map | Regulator requirement, cross-border/sensitive/AI complexity | Hybrid: self-audit + specialist review |
Comparison is an editorial suggestion, not a recommendation of any firm; whether commissioning is mandatory, how to select a firm and how to report are governed by the Measures and regulator requirements.
How to build a data map for websites/forms/AI customer service
Start with six columns: what is collected, why, where stored, who receives it, how long retained and how deleted. List inquiries, cookies, AI chats, CVs, downloads and customer portals separately—not one master diagram.
The data map is the starting point and the easiest part to make look good on paper while failing in practice. Build it by scenario: personal-information fields, purpose, system/vendor, cross-border, retention, deletion/withdrawal and evidence location. Website operations, marketing, sales, HR, IT and legal each own their row; privacy/legal consolidates.
| Scenario | Personal information | Purpose | Third party/cross-border | Retention/deletion | Evidence |
|---|---|---|---|---|---|
| Inquiry form | Name, phone, email, company, request | Respond/quote | CRM, email service | Retention, deletion ticket | Form config, privacy notice |
| Cookies/analytics | IP/device ID, browsing behaviour | Analytics/marketing | GA4, Baidu Tongji | Consent validity, withdrawal | Consent config, script list |
| AI customer service | Chat, contact, attachments | Support/pre-sales | Model/support vendor | Training-off, deletion | DPA, data-flow diagram |
| Recruitment | CV, phone, education/work history | Recruitment | ATS/job platform | Retention, deletion | Notice, access, deletion record |
| Download centre | Name, phone, email, company | Document access/lead | CRM/marketing automation | Retention, unsubscribe | Form gate, notice |
| Customer portal/dealers | Account, orders, contacts | Delivery/after-sales | Cloud, ERP/CRM | Account closure, deletion | Access, logs, contract |
The data map is an editorial template; fields, systems, cross-border and retention must reflect actual processing—do not copy blindly.
Audit evidence: what gets missed most?
The most-missed items are not the privacy policy but consent records, supplier contracts, cross-border paths, AI training switches, rights-request tickets and incident drills; each must map to a system and date.
An audit is not a binder of policies. Evidence must answer: where the rule takes effect, who owns it, when it was verified, and whether a sample can be reproduced. The checklist below can be split among legal, IT, marketing, sales, HR and procurement, then indexed and archived.
| Evidence | Question covered | Minimum requirement | Common gap |
|---|---|---|---|
| Data map/system list | What is collected, stored, shared | Scenario, fields, system, vendor, cross-border, retention | Department names only, no systems |
| Privacy policy/notice version | Notice accurate and complete | Version, publication date, screenshot, change log | Page changed without archive |
| Consent/withdrawal record | Consent voluntary, specific, withdrawable | Checkbox log, timestamp, text version, withdrawal ticket | Only a blank form |
| Supplier contract/DPA | Entrusted purpose/term/measures | Contract, data clauses, supervision/audit rights | Service contract only |
| Cross-border path | Outbound transfer compliant | Assessment/standard contract/certification, notice/consent | Contract exists, path does not |
| AI training/takeover settings | Whether chat data is used for training | Training-off screenshot, human takeover, deletion | Vendor oral promise |
| Rights-request tickets | Access/deletion/withdrawal operable | Entry point, ticket, deadline, result | Mailbox with no owner |
| Incident/drill record | Reporting and response | Plan, contacts, drill, post-mortem | Plan never drilled |
Evidence list is an editorial suggestion; specific evidence types, retention and audit procedures follow applicable law, the audit guidelines and company policy.
How should a 90-day plan be sequenced?
Weeks 1–2 set scope and owner; weeks 3–4 fix notices/consent/contracts; weeks 5–6 review cross-border/AI/sensitive scenarios; weeks 7–8 sample-test; weeks 9–12 report, remediate and schedule the next review.
If starting now, do "scope + evidence" before "sampling + report". Do not buy a tool first or ask a vendor to write a template report; the value of the audit is finding real gaps, assigning remediation owners and setting a review date.
| Phase | Actions | Outputs | Owner |
|---|---|---|---|
| Weeks 0–2 | Set scope, applicable situation, owner, data map and system list | Scope note, data map, evidence list | Privacy/legal |
| Weeks 3–4 | Fix privacy notice, consent/withdrawal, supplier contracts/DPAs | Version record, consent log, contract list | Legal/marketing/procurement |
| Weeks 5–6 | Review cross-border, AI/automated decisions, sensitive data, minors | Path note, assessment, AI settings | Legal/IT/business |
| Weeks 7–8 | Sample-test forms, cookies, access/deletion, support tickets, permissions | Sample sheet, interview notes, issue list | Audit/IT |
| Weeks 9–10 | Consolidate findings, rate, remediation plan, management communication | Findings, remediation plan | Audit/owner |
| Weeks 11–12 | Finalise report, track remediation, review and next audit date | Audit report, remediation log, review record | Privacy/legal |
The 90-day plan is an editorial suggestion; deadlines, reporting and remediation periods for regulator-required audits follow the Measures and regulator requirements.
Audit report/remediation acceptance checklist
Acceptance checks scope, sample, findings, basis, remediation, owner and review. A report is not a "conclusion page"; it must reconcile to specific systems, fields and dates.
A report saying "basically compliant" is meaningless unless it states which systems were audited, what samples were selected, which rule applies, what was found, who owns remediation and when it will be reviewed. The checklist can be shared by internal audit, legal, IT, business owners and an external firm.
| Check | Pass standard | Evidence | If failed |
|---|---|---|---|
| Scope | Systems/scenarios/subsidiaries/suppliers clearly bounded | Scope note, system list | Add scope/justify exclusion |
| Basis | Maps to law/Measures/guideline clauses | Clause mapping | Add basis/reassess |
| Sample | Method, size and high-risk coverage stated | Sample sheet, raw records | Add sample/re-sample |
| Findings | Facts, impact, risk rating, owner | Issue list, screenshot/ticket | Add facts/justify rating |
| Remediation | Action, deadline, verification | Remediation log, review record | Redo/escalate |
| Report | Traceable conclusion, complete annexes, signature/seal | Report, annexes, approval | Return for completion |
| Reporting | Regulator-required filings submitted on time | Receipt, remediation report | File/explain |
| Review | Next audit date and owner clear | Annual plan, calendar | Add plan |
The checklist is an editorial suggestion; report format, recipient and remediation deadlines follow the Measures, regulator requirements and professional advice.
Who should read this, who should not, and what decision does it support?
It fits companies with websites, forms, CRM or AI customer service preparing for customer audits or regulator communication. It does not fit teams without a data map/owner, or those wanting one report to replace remediation.
Who should read: owners, legal/privacy, IT/security, marketing, sales/CRM, HR and procurement; teams building websites, forms, cookie consent, AI customer service or cross-border data projects; companies deciding whether to self-audit or commission, planning 90 days, or preparing for regulator/customer review. Who should not: teams without a data map, system list or privacy owner; projects expecting one report to replace remediation or a vendor to "guarantee pass"; teams treating a compliance audit as MLPS, ISO 27001 or an annual privacy-policy check. Decisions supported: whether an audit/commission is required, scope and frequency, data map and evidence, self-audit vs professional firm, 90-day plan, report and remediation acceptance.
FAQ
Must every company conduct a PIPL compliance audit?
PIPL requires personal-information handlers to conduct regular compliance audits, and the Measures add detail. A handler processing more than 10 million individuals' personal information should audit at least every two years; other handlers should set a reasonable frequency. Whether a regulator requires a professional firm depends on significant risk, possible harm to many individuals or incident thresholds. Confirm applicability against actual processing and counsel's advice.
Is "10 million" website traffic or customer count?
The text refers to processing personal information of more than 10 million individuals, not website traffic, followers or page views. It should be understood as the number of individuals whose personal information is processed, but the counting method, deduplication and group consolidation should be confirmed with counsel/authorities. Do not substitute traffic data.
Must a self-audit report be submitted to the regulator?
A self-initiated audit focuses on regular auditing under the Measures and guidelines, retaining the report and remediation record. A regulator-required audit involves selecting a firm as required, completing within the deadline, and reporting the report and remediation. The scope, format and deadline for filing follow the regulator's requirements; do not infer them yourself.
Does hiring a professional firm guarantee a pass?
No. The firm must be independent and objective, may not subcontract, and the same firm/lead auditor may not conduct more than three consecutive audits for the same subject. The report is a regulatory reference, not an immunity certificate. The company remains responsible for data, evidence, remediation and ongoing compliance. Assess capability, scope, method and confidentiality—not price alone.
Our website only collects inquiries. Do we still need an audit?
If you process personal information, you may be a personal-information handler and must meet notice, consent, minimisation, retention and rights-response duties. Whether you meet the mandatory audit/commission threshold depends on scale, risk, incidents and regulator requirements. Inquiry forms, cookies, AI customer service and CRM are often the first sampled areas; start with a data map and evidence self-check.
How should findings be remediated and reviewed?
Rate findings by risk, assign an owner, action, deadline and verification method. For regulator-required audits, remediate and report as required (the Measures provide for a remediation report within 15 working days after completion). For self-audits, review at 30/60/90 days and include open issues in the next audit scope.
Bottom line
For a 2026 PIPL compliance audit, first determine whether you process more than 10 million individuals and whether a regulator requires a professional firm, then map website/forms/cookies/AI customer service/CRM to legal basis, notice, entrusted processing, cross-border, rights and incident evidence. Self-audit may be internal or voluntarily commissioned; regulator-required audits must use a firm. Reports and remediation must reconcile to systems, fields and dates.
Method and limits
This article is public law, departmental rules, national standards and editorial method, not legal advice, an audit conclusion, compliance certification or regulatory determination for any company, website, system, data set or project. It uses no unpublished client data, audit reports or regulator communications. The applicability table, scope table, data map, evidence list, 90-day plan and acceptance checklist are editorial suggestions; specific audit situations, counting, reporting, remediation deadlines and liability are governed by the law, authorities, audit guidelines and counsel/professional advice. Laws and implementing rules change; the latest official text governs.
Sources
Information is current to 30 October 2026; each official/primary page governs its own scope and version.
- Personal Information Protection Compliance Audit Measures (CAC Order No. 18, effective 1 May 2025): cac.gov.cn. Article 3 self-audit, Article 4 10 million/two years, Article 5 regulator triggers, Articles 10–11 reporting/remediation, annex audit guidelines.
- CAC Q&A on the Measures: cac.gov.cn. Two audit situations, frequency, firm selection, reporting and remediation.
- Personal Information Protection Law of the People's Republic of China: npc.gov.cn. Article 54 regular compliance audit; Article 64 regulator-required audit.
- GB/T 39335-2020, Information security technology—Personal information security impact assessment guide: National Standards Full-text Platform. Impact-assessment method that can support audit sampling/risk assessment.
- CAC expert interpretation on the Measures: cac.gov.cn. Policy background and audit points.