GB/T 46903-2025Data security technology - Personal information protection compliance audit requirements (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part

1.Structure and Drafting Rules of Standardization Documents". Drafting. Please note that some content in this document may involve patents. The issuing organization of this document assumes no responsibility for identifying patents. This document was proposed and is under the jurisdiction of the National Cybersecurity Standardization Technical Committee (SAC/TC260). This document was drafted by: China Electronics Technology Standardization Institute, and the Data and Technology Support Center of the Cyberspace Administration of China (CAC). China Electronics and Information Industry Development Research Institute, China Academy of Information and Communications Technology, National Computer Network Emergency Response Technical Team/Coordination Center, National Information Center Information Technology Security Research Center, Third Research Institute of the Ministry of Public Security, Tsinghua University, Nanjing Audit University, Beijing Kuaishou Technology Co., Ltd., Ant Technology Group Co., Ltd., Beijing Douyin Information Service Co., Ltd., Shenzhen Tencent Computer Systems Co., Ltd., Lenovo (Beijing) Co., Ltd. Company, Taotian Co., Ltd., Beijing Xiaoju Technology Co., Ltd., Beijing Shidai Xinwei Information Technology Co., Ltd., Huawei Technologies Co., Ltd., Beijing Volcano Engine Technology Co., Ltd., Guangxi Power Grid Co., Ltd., Alibaba Cloud Computing Co., Ltd., Honor Terminal Co., Ltd., and Mashangxiao. Fei Financial Co., Ltd., and Guangzhou Nansha Smart City Big Data Co., Ltd. The main drafters of this document are. Yao Xiangzhen, Hu Ying, Liu Xing, Gao Chao, Hao Chunliang, Wang Zhicheng, Guo Zhenhuan, Zhao Li, Yan Xiaoli, Li Anlun, and Gao Yue. Min Dong, Yang Lingling, Chen Yang, Yi Li, Yang Tao, Liu Xize, Li Zhuojun, Wang Jun, Zou Xiang, Chen Bing, Liu Yun, Yu Xiaobing, Luo Hongwei, Wang Xin, Bai Xiaoyuan Shi Yuzhen, Tian Shen, Li Yijing, Zhang Yanan, Mao Anna, Zhang Xin, Jia Yumeng, Gu Wei, Lu Yan, Sun Tie, Xu Rui, Wang Xinjie, Yi Qiang, Ma Shuo, Zhou Yujie Liu Ying, Zhu Shiyang, Liang Zhezhe, Shi Yarong, Zhao Xiaona, Yin Danna, Li Honggang. Data security technology Personal information protection compliance audit requirements

1 Scope

GB/T 46903-2025 is the Chinese national standard covering auditing an organisation's handling of personal information - the lawful basis and consent, the minimisation and retention, the sharing and cross-border transfer, the rights of the individual and the security measures, with the evidence an auditor collects for each. China's personal information law requires these audits, and this is what the auditor works from. First edition, 25,000 words. It was issued on 31 December 2025 and has been in force since 1 July 2026, as a first edition. The document is under the responsibility of the Standardization Administration of China. This page is published from the official record of the 2025 edition; the clause text of a standard this recent is not yet in circulation, and the figures, limits and tables it contains are those of the document itself, delivered in full with the English translation.

This document outlines the principles for personal information protection compliance auditing, and specifies the overall requirements, implementation procedures, and procedures for such audits. Content and methods. This document applies to personal information processors and professional organizations conducting personal information protection compliance audits.

2 Normative references

The contents of the following documents, through normative references within the text, constitute essential provisions of this document. Dated citations are not included. For references to documents, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies. This document.

GB/T 25069 Information Security Technical Terminology

GB/T 35273 Information Security Technology - Personal Information Security Specification

GB/T 45574 Data Security Technology - Security Requirements for the Processing of Sensitive Personal Information

3 Terms and Definitions

The terms and definitions defined in GB/T 25069 and GB/T 35273, as well as the following terms and definitions, apply to this document.

3.1 Supervision that reviews and evaluates whether personal information processors' personal information processing activities comply with laws and administrative regulations. Activity.

Note. This is abbreviated as compliance audit.

3.2 Possesses the capability to conduct personal information protection compliance audits, and has audit personnel, facilities, and funding commensurate with its services, enabling it to provide... Organizations that provide personal information protection compliance audit services.

Note. Abbreviated as professional organization.

3.3 auditor Among personal information processors or professional organizations, those with the capability to conduct compliance audits on personal information protection are responsible for assessing whether personal information processing activities are in compliance with regulations. Personnel who conduct independent reviews and evaluations in accordance with laws and administrative regulations.

3.4 Audit findings The facts, differences, risks, or issues that compliance auditors identify in relation to the auditee after performing audit procedures.