The PRC Personal Information Protection Law (PIPL) effective since 1 November 2021, requires that data processors must designate DPOs (人信息保护负责人). DPOs shall supervise the personal data processing activities of the data processor as well as the protective measures taken thereby, among others. Data processors residing outside China and processing personal data of PRC data subjects shall designate a DPO representative within China for data security matters concerning PRC data subjects.
Any natural person can serve as DPO and nationality or residency (Chinese or otherwise) is not relevant in this context as long as the data processor is based in China. If the data processor is however located outside China, it must appoint a DPO who is located in China. Either way, best practice regimes suggest that any DPO shall have relevant expertise in the field of IT/data protection as well as a certain proven track record/seniority in the field and a decent understanding of the Chinese regulatory and industry requirements.
On 18 July 2025, the China Cyberspace Administration (CAC) launched its new online registration platform Personal Data Protection System (个人信息保护业务系统, https://grxxbh.cacdtsc.cn/) (Platform) for DPO registration.
According to PIPL, the "Measures for the Administration of Personal Data Protection Compliance Audits个人信息保护合规审计管理办法", and the "Instructions for Filling out the Personal Data Protection Officer Information Reporting System个人信息保护负责人信息报送系统填报说明", the DPO registration obligation shall apply to data processors who process personal data of more than 1 million data subjects during any twelve months period.
Registration must be completed on the Platform which involves among others uploading the following:
From the online registration interface of the Platform, the system also provides an access for non-China based data processors. When registering an account, they need to provide their foreign and Chinese names as well as the names and contact information of their designated DPO in China and other related information.
For any DPO registration application on the Platform, the progress status will be notified via SMS to the person handling the application. Generally, the material review should be completed within 15 working days after the complete submission was uploaded onto the Platform.
Depending on the actual status, the application status on the Platform will show any of the following: "Information Reporting Completed", "Returned for Rectification" or "Review Failed". If the status reads "Returned for Rectification", the applicant shall submit the missing/corrected documents within 10 business days of such status showing for the first time, otherwise the status will change to “Review Failed” eventually.
Except for the name of the data processor and the progress status, no other information will be available for online review. Thus, data processors are well advised to retain backup copies of the submitted materials.
The following deadlines must be kept in mind for the DPO registration on the new platform:
29 August 2025 for data processors who reached the 1 million data subject threshold before 18 July 2025
for data processors who reach(ed) the 1 million data subject threshold after 18 July 2025, they must conduct the DPO registration within 30 days as of reaching the said threshold
Susanne Rademacher
Kelly Tang
