Legislationsby Glyph
ChinaChinaLawCAC Order No. 18
Measures for Personal Information Protection Compliance Audits
Requires personal information handlers to conduct regular compliance audits, with those processing data on more than 10 million people auditing at least every two years, and lets regulators order audits when risks arise.
Measures enter into forceMay 1, 2025 1 year ago
- Body
- Cyberspace Administration of China
- In effect since
- May 1, 20251 year ago
Timeline
May 1, 2025 1 year ago
Feb 14, 2025 1 year ago
Measures published by the Cyberspace Administration of China
Feb 12, 2025 1 year ago
May 20, 2024 2 years ago
Related
ChinaAI Legislation
China proposed rules governing artificial intelligence that span data, computing, algorithms, deepfakes, and privacy.
ChinaProvisions on Personal Information Protection by Large Personal Information Handlers (Draft for Comment)
Draft rules that would designate handlers processing personal information of 10 million or more people or providing important network services as large handlers, subject to registration, heightened security duties and independent personal information protection supervisory committees.
ChinaInterim Measures for the Administration of AI Anthropomorphic Interactive Services
Regulates AI companion and other human-like emotional interaction services, barring virtual intimate relationship services for minors and requiring safeguards against emotional dependence and separate consent before chat data is used for training.
ChinaDecision Amending the Cybersecurity Law
Amends the Cybersecurity Law to add a provision supporting AI research, infrastructure, ethics and risk monitoring, raise fines for network security violations, and align liability with the Data Security Law and Personal Information Protection Law.
ChinaMeasures for Certification of Personal Information Export
Sets out the certification route for transferring personal information out of China, including which handlers may use it, the certification bodies and process, and supervision of certified transfers.
ChinaMeasures for the Administration of National Network Identity Authentication Public Services
Creates a voluntary state-run online identity system that issues citizens a network ID number and network certificate so they can verify their identity to platforms without handing over ID card details, while platforms must keep other verification options.
ChinaNetwork Data Security Management Regulations
Implements the Cybersecurity Law, Data Security Law and Personal Information Protection Law with detailed rules on personal information handling, important data protection, cross-border data transfers and obligations of large online platforms.
ChinaProvisions on Promoting and Regulating Cross-Border Data Flows
Relaxes China's data export rules by exempting several categories of cross-border transfers from security assessment, standard contract or certification requirements and letting free trade zones set negative lists.
Change log
- AddedAdded to the list. Set by hand from the official record.Sep 27
Summaries of public legislative records, executive actions and court rulings, for reference, not legal advice. Check the official page linked on each item. First seen 2026-09-27. Checked against the official source.