On July 18, 2025, the Cyberspace Administration of China (CAC) published a Notice on Launching the Reporting Mechanism for Personal Information Protection Officers (Notice).
According to the Notice, since the publishing thereof, if a personal information processor has processed personal information for up to 1 million people, it shall complete the information reporting within 30 working days from the date when the number is reached. If the number of the personal information processed by the personal information processor has reached one million people before the issuance of the Notice, they shall complete the information reporting by August 29, 2025. In case there is a substantial change in the reported information, the information shall be changed within 30 working days from the date of change. The above information reporting shall be reported online.
The reporting mechanism for the personal information protection officers involved in the said Notice is to carry out the mechanism of the personal information protection officers provided in the Personal Information Protection Law, which provided in Article 52 that “A personal information processor that handles personal information up to the amount specified by the cyberspace administration department shall designate a personal information protection officer, who is responsible for supervising the personal information processing activities, as well as the protection measures taken. The personal information processor shall disclose the contact information of the personal information protection officer and report the name and contact information thereof to the department that fulfills the responsibility for personal information protection.”
Further, in accordance with Article 21 of the Measures for the Administration of Personal Information Protection Compliance Audits, “A personal information processor that handles the personal information of more than 1 million people shall designate a personal information protection officer who is responsible for personal information protection compliance audits of the personal information processor. A personal information processor that provides important Internet platform services, has a large number of users, and has a complex type of business shall establish an independent organization composed primarily of outside members to oversee the personal information protection compliance audit.” Thus, the said reporting mechanism is good for the government to supervise the obligation performance of the personal information protection officer.
It is worth noting that the reporting mechanism for the personal information protection officers herein does not apply to all the personal information processors; only those who handle the personal information of more than 1 million people need to establish such a mechanism. Thus, when an enterprise handles the personal information of more than 1 million people, it shall designate a personal information protection officer in accordance with the relevant law and regulation, as well as make online reporting as per the Notice herein. Otherwise, it may face adverse consequences of administrative punishments, such as warning, confiscation of illegal gains, fining, and so on.
In accordance with Article 66 of the Personal Information Protection Law provides that “anyone who handles personal information in violation of the provisions of this Law, or handles personal information without fulfilling the obligations of personal information protection stipulated in this Law, shall be ordered by the department responsible for the fulfillment of the duties of personal information protection to rectify, be given a warning, confiscate the illegal gains, and be ordered to suspend or terminate the provision of the services for the application that handles personal information in violation of the law; and if it refuses to rectify, it shall also be imposed a fine of not more than one million yuan; and the supervisory personnel in charge of the directly responsible persons and other directly responsible personnel shall be fined not less than 10,000 yuan and not more than 100,000 yuan. In case of the violations stipulated in the preceding paragraph and the circumstances are serious, the department responsible for personal information protection at or above the provincial level shall order to rectify, confiscate the illegal gains, and impose a fine of not more than 50 million yuan or not more than five percent of the turnover of the previous year, and may also order the suspension of the relevant business or suspend the business for rectification, or notify the competent department concerned to revoke the relevant business permit or revoke the business license; and impose a fine of not less than 100,000 yuan and not more than 1 million yuan on the directly responsible supervisory personnel and other directly responsible personnel and may decide to prohibit them from acting as directors, supervisors, senior management personnel and personal information protection officers of the relevant enterprises within a certain period of time.”
According to the Notice, since the publishing thereof, if a personal information processor has processed personal information for up to 1 million people, it shall complete the information reporting within 30 working days from the date when the number is reached. If the number of the personal information processed by the personal information processor has reached one million people before the issuance of the Notice, they shall complete the information reporting by August 29, 2025. In case there is a substantial change in the reported information, the information shall be changed within 30 working days from the date of change. The above information reporting shall be reported online.
The reporting mechanism for the personal information protection officers involved in the said Notice is to carry out the mechanism of the personal information protection officers provided in the Personal Information Protection Law, which provided in Article 52 that “A personal information processor that handles personal information up to the amount specified by the cyberspace administration department shall designate a personal information protection officer, who is responsible for supervising the personal information processing activities, as well as the protection measures taken. The personal information processor shall disclose the contact information of the personal information protection officer and report the name and contact information thereof to the department that fulfills the responsibility for personal information protection.”
Further, in accordance with Article 21 of the Measures for the Administration of Personal Information Protection Compliance Audits, “A personal information processor that handles the personal information of more than 1 million people shall designate a personal information protection officer who is responsible for personal information protection compliance audits of the personal information processor. A personal information processor that provides important Internet platform services, has a large number of users, and has a complex type of business shall establish an independent organization composed primarily of outside members to oversee the personal information protection compliance audit.” Thus, the said reporting mechanism is good for the government to supervise the obligation performance of the personal information protection officer.
It is worth noting that the reporting mechanism for the personal information protection officers herein does not apply to all the personal information processors; only those who handle the personal information of more than 1 million people need to establish such a mechanism. Thus, when an enterprise handles the personal information of more than 1 million people, it shall designate a personal information protection officer in accordance with the relevant law and regulation, as well as make online reporting as per the Notice herein. Otherwise, it may face adverse consequences of administrative punishments, such as warning, confiscation of illegal gains, fining, and so on.
In accordance with Article 66 of the Personal Information Protection Law provides that “anyone who handles personal information in violation of the provisions of this Law, or handles personal information without fulfilling the obligations of personal information protection stipulated in this Law, shall be ordered by the department responsible for the fulfillment of the duties of personal information protection to rectify, be given a warning, confiscate the illegal gains, and be ordered to suspend or terminate the provision of the services for the application that handles personal information in violation of the law; and if it refuses to rectify, it shall also be imposed a fine of not more than one million yuan; and the supervisory personnel in charge of the directly responsible persons and other directly responsible personnel shall be fined not less than 10,000 yuan and not more than 100,000 yuan. In case of the violations stipulated in the preceding paragraph and the circumstances are serious, the department responsible for personal information protection at or above the provincial level shall order to rectify, confiscate the illegal gains, and impose a fine of not more than 50 million yuan or not more than five percent of the turnover of the previous year, and may also order the suspension of the relevant business or suspend the business for rectification, or notify the competent department concerned to revoke the relevant business permit or revoke the business license; and impose a fine of not less than 100,000 yuan and not more than 1 million yuan on the directly responsible supervisory personnel and other directly responsible personnel and may decide to prohibit them from acting as directors, supervisors, senior management personnel and personal information protection officers of the relevant enterprises within a certain period of time.”