On February 12, 2025, the Cyberspace Administration of China (CAC) released the final version of measures outlining requirements for companies to undergo a compliance audit on personal information protection. The Measures for the Administration of Compliance Audits on Personal Information Protection (hereinafter the “Measures”), which were first released in draft form in 2023, require companies that process personal information in China to undergo an audit to ensure compliance with China’s personal information and data protection regulations. Under the measures, companies can either appoint an internal department or a third-party agency to conduct the audit. Under certain circumstances, the cybersecurity authorities may require companies to appoint a professional institution to conduct the audit on their behalf.