PIPCA has arrived, and it marks a significant addition to the compliance landscape. With China’s new personal information audit regime now in force, data buyers who source alternative data from or through China are seeing increased regulatory scrutiny and added compliance considerations. The requirements are more detailed, definitions of personal information have expanded, and the expectations for documentation and transparency have grown. If you are navigating the global data marketplace in 2025, understanding what has changed and what it means for your risk profile is essential.

BACKGROUND AND PURPOSE

On 14th February 2025, China’s Cyberspace Administration (CAC) released the Administrative Measures for Personal Information Protection Compliance Audits (PIPCA)...