On July 18, 2025, the Cyberspace Administration of China (CAC) officially issued the "Notice on Filing Personal Information Protection Officers," requiring personal information processors handling the personal information of over one million individuals to complete the online filing of their Personal Information Protection Officer (PIPO) by August 29, 2025. This marks a significant milestone in the transition of the PIPO system from legislative framework to full implementation since the enforcement of the PIPL. For enterprises, filing is not only a legal obligation but also a crucial measure to demonstrate compliance and mitigate regulatory risks. This article provides a detailed operational guide to help enterprises efficiently and compliantly complete the PIPO filing process.
Filing Portal and Basic Procedures
PIPO filing is conducted through the online filing portal designated by the Cyberspace Administration of China. Enterprises must register an account using the identity of a legal representative or an authorized representative, and log into the filing system after completing real-name authentication. The entire filing process consists of five steps: first, filling in the basic information of the enterprise; second, providing details of the personal information protection officer; third, entering information on the scale of data processing; fourth, uploading supporting documents; and fifth, submitting the filing application and awaiting review. The review period typically takes 10 to 15 working days, after which the enterprise will receive an electronic filing certificate upon approval. During the review process, the filing system may request the enterprise to supplement materials or correct information, and the enterprise must respond within 5 working days upon receiving the notification.
Required Filing Materials
- ›Basic Information of the Enterprise: Unified Social Credit Code, Enterprise Name, Registered Address, Industry Category, Enterprise Scale (Number of Employees and Annual Revenue Range) ---ITEM--- Identity Information of the Responsible Person: Name, ID Card Number (for Chinese nationals) or Passport Number (for foreign nationals), Contact Phone Number, Email Address, Position, Appointment Date ---ITEM--- Qualifications of the Responsible Person: Proof of Relevant Work Experience, Professional Certification Certificates (e.g., CIPP, CISP, ISO 27701, etc., optional but advantageous), Educational Certificates ---ITEM--- Data Processing Scale Information: Total Number of Personal Information Data Subjects Processed, Types of Personal Information Involved (General Personal Information and Sensitive Personal Information), Description of Main Processing Activities ---ITEM--- Internal Appointment Documents of the Enterprise: Sealed PIPO Appointment Letter or Board Resolution, Clearly Defining the Scope of Authority and Reporting Line of the PIPO ---ITEM--- Personal Information Protection System Documents: Summary of the Enterprise’s Current Personal Information Protection Management System or Privacy Policy
Common Reasons for Returns and How to Address Them
- ›Incomplete Information: Not all required fields are filled, or uploaded documents are missing pages or are unclear. Solution: Use the completeness check feature in the filing system to verify each item before submission. ---ITEM--- Unqualified Responsible Person: The responsible person lacks proof of relevant work experience or fails to meet the management member requirements for large online platforms. Solution: Confirm in advance whether the candidate meets the qualifications and adjust the selection if necessary. ---ITEM--- Incorrect Processing Scale Reporting: The number of data subjects is significantly low or inconsistent with the business scale of the enterprise, raising doubts among reviewers. Solution: Base statistics on actual data processing records and logs to ensure accuracy and authenticity. ---ITEM--- Non-standard Appointment Document: The appointment letter lacks the signature of the legal representative or the company seal, or the scope of authority is unclear. Solution: Use the appointment letter template provided by the CAC to ensure the format and content meet the requirements. ---ITEM--- Invalid Contact Information: The reviewer is unable to reach the responsible person via the provided contact number during verification. Solution: Ensure the phone number provided can be reached during working hours.
Ongoing Obligations After Filing
Completing the filing is not the endpoint; enterprises must also fulfill a series of ongoing obligations after filing. According to Article 54 of the PIPL and the provisions of the "Network Data Security Management Regulations," enterprises processing personal information of more than 10 million individuals must commission a professional institution to conduct a compliance audit of their personal information processing activities at least once every two years. For enterprises processing personal information of 1 million to 10 million individuals, it is recommended to conduct a compliance audit every three years. The PIPO should regularly (recommended at least quarterly) submit a personal information protection work report to the enterprise's management, reporting on compliance status, risk discoveries, and improvement suggestions. Additionally, the PIPO's contact information should be made publicly available through channels such as the enterprise's official website, privacy policy, or app, ensuring that data subjects and regulatory authorities can easily make contact.
Change and Cancellation Filing
When registered information changes, enterprises should promptly update their filing. According to the requirements of the CAC, if the PIPO changes (including personnel replacement, contact information updates, position changes, etc.), a change application must be submitted through the filing system within 15 working days from the date of the change. If an enterprise undergoes mergers, divisions, or business adjustments that result in significant changes in data processing scale, the filing information should also be updated in a timely manner. If an enterprise no longer meets the threshold of 1 million individuals (e.g., due to business contraction), it may apply to deregister the filing but must provide explanatory materials regarding the changes in data processing scale. It is particularly important to note that during the transition between the outgoing and incoming PIPO, the enterprise must ensure there is no gap period without someone fulfilling the role. It is recommended to complete the appointment and filing change of the successor before the departure of the outgoing PIPO.
Special Considerations for Multinational Corporations
- ›Foreign enterprises without a physical presence in China that process personal information of over 1 million individuals within China must appoint a local representative and complete the PIPO filing. ---ITEM--- The PIPO for a multinational enterprise's Chinese subsidiary should be a local team member in China and cannot be remotely held by the global DPO from the overseas headquarters. ---ITEM--- The filing system currently only supports a Chinese interface, and all materials must be submitted in Chinese or with certified Chinese translations. ---ITEM--- For multinational groups with multiple legal entities in China, each independent personal information processor is required to file separately in principle.
Practical Time Planning Suggestions for Filing
To ensure the filing is completed before the deadline, it is recommended that enterprises follow the timeline below. Phase 1 (1-2 weeks): Internal decision-making stage, including appointing the PIPO, drafting appointment documents, and obtaining management approval. Phase 2 (1 week): Document preparation stage, involving gathering and organizing all required materials for filing and verifying data processing scale statistics. Phase 3 (1-2 business days): Online submission stage, including registering a filing account, completing filing information, uploading materials, and submitting. Phase 4 (2-3 weeks): Review waiting stage, where close attention should be paid to notifications from the filing system, and any requests for supplementary materials should be promptly addressed. It is advisable to allocate at least 6 weeks to allow for potential rejections and resubmissions. Additionally, it is strongly recommended to engage external legal counsel to review the filing materials before formal submission to ensure accuracy and completeness.
