GB/T 46903-2025Data security technology - Personal information protection compliance audit requirements (English PDF)

National Standard of the People's Republic of China

ICS

35.030

Classification

L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

Contents

• Preface
• 1.Scope
• 2 Normative References
• 3.Terms and Definitions
• 4.Principles and General Requirements for Personal Information Protection Compliance Audits
• 4.1 Compliance Audit Principles
• 4.2 Requirements for Conducting Compliance Audits
• 4.3 Requirements for Compliance Auditors
• 5.1 Overview
• 5.2 Audit Preparation Phase
• 5.3 Audit Implementation Phase
• 5.4 Audit Report Stage
• 5.5 Problem Rectification Phase
• 5.6 Archiving Management Phase
• 6.Content and Methods of Personal Information Protection Compliance Audit
• 6.1 Legality of Personal Information Processing Activities
• 6.2 Normative Standards for Personal Information Processing Rules
• 6.4 Processing personal information jointly with other personal information processors
• 6.5 Entrusted processing of personal information
• 6.7 Providing personal information processed by other personal information processors
• 6.8 Utilizing automated decision processing for personal information
• 6.9 Disclosure of Personal Information Based on Individual Consent
• 6.10 Install image collection and personal identification devices in public places.
• 6.11 Processing publicly disclosed personal information
• 6.12 Processing Sensitive Personal Information
• 6.13 Personal information of minors under the age of fourteen (26 items)
• 6.14 27 Personal Information Provided to Overseas Entities
• 6.15 Status of Protection of the Right to Deletion of Personal Information
• 6.16 Protecting Individuals' Rights in Personal Information Processing Activities
• 6.17 Respond to individuals and explain their personal information processing rules
• 6.18 Internal Management System and Operating Procedures for Personal Information Protection
• 6.19 Safety Technical Measures
• 6.20 Development and Implementation of Education and Training Plans
• 6.21 Personal Information Protection Officer
• 6.22 Impact Assessment on Personal Information Protection
• 6.23 Emergency Response Plan for Personal Information Security Incidents
• 6.24 Emergency Response and Handling of Personal Information Security Incidents
• 6.25 Large Internet Platform Rule
• 6.26 Personal Information Protection Social Responsibility Report
• Appendix A (Informative) Evidence from Personal Information Protection Compliance Audit
• Appendix B (Informative) Template for Audit Working Papers on Personal Information Protection Compliance
• Appendix C (Informative) Template for Personal Information Protection Compliance Audit Report
• References