China Releases Guidelines on Reporting the Appointment of Data Protection Officers
- Rose Li, XL Law & Consulting
- Jul 31
- 4 min read
On July 18, 2025, the CAC issued guidance on reporting the appointment of personal information protection officers. Handlers that reached the 1,000,000-individual threshold before July 18, 2025, must complete their reporting obligations by August 29, 2025. Those that reach the threshold afterward must finish their reporting within 30 business days of reaching it.
Overseas (U.S.) handlers that process the personal information of 1,000,000 or more individuals in China must fulfill their reporting obligations through the agency they established in China or through a PRC-based representative as designated under PIPL Article 53.
China’s Personal Information Protection Law (“PIPL”) requires that personal information handlers handling more than the threshold specified by the Cyberspace Administration of China (“CAC”) appoint a personal information protection officer (“PIPO”) and report the PIPO’s name and contact information to the CAC. In February 2025, the CAC released the Measures for the Administration of Compliance Audits on Personal Information Protection (“Measures”), clarifying that personal information handlers handling the personal information of 1,000,000 or more individuals are required to appoint a PIPO responsible for the personal information protection compliance audit (as discussed in our XL Insights+ article). On July 18, 2025, the CAC published guidelines with details on reporting the appointment of PIPOs (“Guidelines”).
Who Is Required to Report?
A PIPO must be appointed in any of the following scenarios:
Handling of personal information of 1,000,000 or more individuals, as required by the Measures;
Handling of sensitive personal information of 100,000 or more individuals, as required by the Data Security Technology – Security Requirements for Handling of Sensitive Personal Information, which will come into effect on November 1, 2025; or
A personal credit reference agency, or a corporate credit reference agency storing or handling credit information of 1,000,000 or more enterprises.
It is important to note that the recently published Guidelines only apply to domestic and overseas personal information handlers that handle 1,000,000 or more individuals. The Guidelines do not apply to reporting under the other two scenarios listed above.
Timelines For Reporting
Handlers that have reached the 1,000,000-individual threshold before July 18, 2025 must complete their reporting obligations by August 29, 2025. Handlers that reach the 1,000,000-individual threshold on or after July 18, 2025 must complete their reporting obligations within 30 business days of reaching this threshold. Any changes to the reported information must be filed with the CAC within 30 business days of the change.
How To Report
Handlers must submit the filings to the local CAC via the online portal. If a handler has branches or subsidiaries in China, such handler may fulfill the reporting obligations on behalf of its branches or subsidiaries.
What to Report
Handlers are required to submit the following materials via the online portal:
Information about the handler, including their name, address, the name and title of their legal representative, the name, title, phone number and email address of their agent, the number of employees of the handler, and the name and number of employees in the personal information protection department established within the handler (if any);
Information about the PIPO, including their name, title, nationality, phone number, and email address;
Information about handled personal information, including scale and categories of handled personal information and sensitive personal information, number of monthly active users, industries/fields in which personal information is collected, methods of collecting personal information (e.g., app, mini-program, website, WeChat official account, or offline), and list of domain names and IP addresses from which services are provided;
Scanned copy of the handler’s registration certificate and legal representative’s identity document;
Scanned copy of the PIPO's identity document and appointment document;
Scanned copy of the agent's identity document;
Scanned copy of the signed POA and signed commitment.
Implications for U.S. Higher Education Institutions
Because the Guidelines apply to any overseas (U.S.) handlers that handle the personal information of 1,000,000 or more individuals in China, U.S. institutions of higher education should review the volume of personal information they handle in China to see whether they meet the threshold. As explained below, however, the mechanisms for reporting may be difficult for some overseas (U.S.) institutions if they have not established a legal entity in China.
PIPL Article 53 requires overseas handlers to appoint a representative or establish an agency in the PRC for personal information protection purposes and to report the representative or agency’s name and contact information to the CAC. The reporting obligations under the Guidelines must be carried out by the PRC-based representative designated by or agency established by the overseas handler. Information about the PRC-based representative or agency, such as its name and the province and city in which it is located, is also required for online reporting.
U.S. institutions that have established a representative office (RO) or a wholly foreign owned enterprise (WFOE), joint venture or similar entity in China may simply fulfill their reporting obligations through their RO or PRC entity. Institutions without an RO or other legal entity in China can, in theory, carry out their reporting obligations through a PRC-based representative. However, despite the Article 53 requirement that overseas handlers without a legal entity appoint a PRC-based representative, there are currently no regulations or guidelines from the CAC on how to do so. U.S. institutions that reach the 1,000,000-individual threshold and do not have a legal entity in China therefore face a certain degree of uncertainty in the implementation of the reporting process, pending further clarification by the CAC. To ensure compliance with the obligations under the PIPL and the Guidelines, we recommend that these institutions confirm the requirement and process for designating a representative with the local CAC.
