1. Why Conduct a PI Protection Compliance Audit (PI Audit)?
Personal Information Protection Compliance Audit ("PI Audit") is a legal obligation. According to the Personal Information Protection Law (PIPL), all enterprises that process personal information need to conduct a PI Audit. The obligation to conduct a PI Audit makes no distinction regarding the type of personal information; regardless of whether an enterprise processes consumer personal information, customer/supplier personnel information, or employee personal information, a PI Audit is required.
2. When Should a PI Audit Be Conducted?
According to the Measures for the Administration of Personal Information Protection Compliance Audits, enterprises processing the personal information of over 10 million individuals need to conduct a PI Audit at least once every two years.
According to the Regulations on the Protection of Minors in Cyberspace, enterprises processing the personal information of minors should conduct a PI Audit annually.
For other enterprises, the law does not mandate the frequency of PI Audits, but it is recommended that enterprises processing the personal information of over 1 million but not exceeding 10 million individuals conduct a PI Audit once every three years; enterprises processing the personal information of no more than 1 million individuals are advised to conduct a PI Audit once every five years.
For any of the above categories of enterprises, it is recommended to complete the first PI Audit covering all types of the enterprise's personal information as soon as possible, and to reasonably determine the frequency and timing of subsequent audits based on the results of the initial PI Audit.
3. Significance and Value of the PI Audit?
For the Enterprise:
A PI Audit is the best means for the enterprise to "prove its innocence" under the reversal of the burden of proof rule of the PIPL.
It serves as systematic proof of the enterprise's refined data governance, which can be presented to clients and other transaction counterparts.
It can help the enterprise sort out data assets and discover data value.
For the Enterprise Head, DPO, and Heads of Legal/Compliance/IT/Information Security:
It can prevent personal liability (especially criminal liability, and the "capacity penalty" in the administrative field) resulting from personal information compliance issues.
Failure to conduct a PI Audit in accordance with the law may lead to the enterprise facing fines of up to RMB 50 million or 5% of the enterprise's turnover from the previous year for "failing to fulfill personal information protection obligations according to law"; individuals may face fines of up to RMB 1 million and restrictions on serving as senior management.
4. Why Choose Llinks for PI Audit Services?
A PI Audit is an "evaluation of the legality and compliance of an enterprise's PI processing activities," which is essentially a legal judgment.
A PI Audit emphasizes the independence of the auditing institution. Compared to internal enterprise departments, our independence as an external institution is stronger, giving the audit results greater persuasiveness when the enterprise faces government inquiries/investigations.
A PI Audit is highly professional and involves a large amount of work, requiring auditors to possess compound knowledge and skills in network architecture, information security, data compliance, and IT. We have a complete personnel structure and possess professional skills in law, data, computer science, and information security, allowing us to provide clients with all necessary PI Audit resources from a "legal + technical" perspective.
With the premise of maximizing client interests, we can assist clients in completing PI Audit projects in various ways: (1) The client conducts the audit internally, with the Llinks team providing professional support; (2) The Llinks team provides third-party audit services for the client; (3) The Llinks team collaborates with information security and consulting technical service providers to jointly offer third-party audit services for the client.
The Llinks team has long been deeply engaged in providing various types of data compliance legal services, has completed a number of PI Audit projects, and possesses rich experience.
The Llinks team has completed the necessary personnel certification for conducting personal information audits and plans to complete the institutional certification for PI Audits expeditiously.
