New China IT Rules: What Global Businesses Must Know in 2025

If your company processes personal data in China, a new era of oversight is already here. Starting May 1, 2025, the Cyberspace Administration of China (CAC) began enforcing the Personal Information Protection Compliance Audit Measures. These rules make regular audits of data practices mandatory and signal how serious Beijing has become about privacy and security.

Key Points at a Glance

• Regular compliance audits: Any business processing over 10 million individuals’ data must audit every two years.
• Dedicated compliance roles: Firms handling data of over 1 million people must appoint a compliance officer.
• Independent oversight: Large platforms must create external supervisory bodies.
• Tough penalties: Fines can reach up to RMB 50 million or 5% of annual turnover.

Learn more about the Audit Measures on Microsoft’s support page ›

The New Compliance Landscape

China’s Personal Information Protection Law (PIPL) has been in force since 2021, but the new Audit Measures expand its reach. Companies must now evaluate consent flows, storage practices, and cross-border transfers against national standards.

For example, a multinational running an ERP platform in Shanghai must ensure its data pipelines comply with Chinese regulations. Failure to do so could trigger fines or even suspension of operations.

See how JET IT Services helps firms comply with China’s data laws ›

Who Has to Comply?

• Large data handlers: Over 10 million individuals’ personal data → audit at least every two years.
• Mid-sized firms: Over 1 million individuals’ data → appoint a compliance officer.
• Major platforms: More than 50 million registered users or 10 million monthly active users → set up an independent (mainly external) supervisory organization.

How to Conduct the Audit

Businesses can choose:

• Internal audits — using in-house departments that meet CAC guidelines.
• Third-party audits — especially when internal expertise is lacking. Authorities may compel a company to use external professionals in some cases.

Audits must cover everything from consent mechanisms to data storage and cross-border flows.

Request a third-party compliance assessment from JET IT Services ›

Penalties for Getting It Wrong

Under PIPL, minor breaches can cost up to RMB 1 million. Serious violations — such as repeated non-compliance or unlawful data transfers — can reach RMB 50 million (about USD 6.9 million) or 5% of turnover.

Under the Network Data Security Management Regulations (NDSMR), ignoring mandated audits or failing to notify breaches can draw fines of RMB 1–10 million. In extreme cases, regulators may suspend operations or blacklist a company from government procurement.

Even individual officers can be personally liable.

Read our breakdown of China’s data penalties ›

Steps to Stay Ahead

• Map and classify all personal data you process.
• Appoint or upskill a compliance officer.
• Consider an independent audit through an external provider like JET IT Services.
• Review consent mechanisms and cross-border transfers.

Taking these actions not only prevents fines but also builds customer trust.

Need Help Navigating China’s New Rules?

Complying with these measures can be complex. JET IT Services specialises in guiding businesses through China’s regulatory maze — conducting audits, advising on best practices, and ensuring your systems remain secure and compliant.

Don’t leave compliance to chance. Contact JET IT Services today ›

About JET IT Services We help businesses in China overcome IT challenges with reliable, compliant, and secure solutions. From network optimisation to cybersecurity, JET ensures your systems run smoothly so you can focus on growth.