- PIPL creates two distinct governance roles: a personal information protection officer (PIPO) under Article 52, and a domestic dedicated institution or designated representative for overseas processors under Article 53.
《个人信息保护法》设定了两类不同的治理角色：第五十二条项下的个人信息保护负责人（个保负责人），以及第五十三条项下境外处理者须设立的境内专门机构或指定代表。- The 100-million-person threshold is the operative trigger: processors handling over one million individuals’ personal information must designate a PIPO and are subject to the 2025 CAC filing obligation.
一百万人是实际触发线：处理超过一百万人个人信息的处理者必须指定个保负责人，并适用国家网信办 2025 年的报送义务。- The 2025 CAC announcement makes filing online-only via the “Personal Information Protection Business System”, with a 30-working-day deadline for newly qualifying entities and for material changes.
国家网信办 2025 年公告将报送改为”个人信息保护业务系统”线上办理，新达标企业与信息实质性变更均须在 30 个工作日内完成。- Overseas processors with no China entity must still designate a domestic representative, whose legal status, duties and filing are separate from but parallel to the PIPO requirement.
在中国无实体的境外处理者仍须指定境内代表，其法律地位、职责与报送与个保负责人制度相互独立又彼此并行。- The draft large-platform rules tighten PIPO qualifications—management membership, Chinese nationality, five years’ experience, veto and direct-report rights—foreshadowing stricter expectations for major players.
《大型网络平台个人信息保护规定（征求意见稿）》收紧了个保负责人任职资格——管理层成员、中国国籍、五年从业经历、否决权与直接报告权，预示着对头部主体的更高要求。- The PIPO obligation interconnects with Articles 51, 54, 55–56 (PIPIA) and 57 (breach notification); the officer is the coordinator across all of them.
个保负责人义务与第五十一条、第五十四条、第五十五至五十六条（个人信息保护影响评估）及第五十七条（泄露通知）相衔接，该负责人是贯穿各项制度的协调者。- Compared with the EU GDPR’s DPO and representative regime, China’s PIPO is narrower in threshold but imposes an explicit, centralized filing and consistency obligation with public disclosures.
与欧盟 GDPR 的 DPO 及代表制度相比，中国个保负责人制度的适用门槛更窄，但施加了明确的集中报送义务，并要求与公开披露保持一致。
Personal Information Protection Officer and the Domestic Institution or Designated Representative for Overseas Processors under China’s PIPL: Governance Roles and Filing Obligations | 《个人信息保护法》项下的个人信息保护负责人与境外处理者境内专门机构、指定代表：治理角色与报送备案义务
Two Governance Roles, Two Legal Bases
China’s PIPL does not rely on a single compliance officer model. It separates two roles often conflated by foreign investors. Article 52 addresses the personal information protection officer (PIPO)—an internal role for processors reaching a statutory volume. Article 53 addresses the domestic dedicated institution or designated representative required of overseas processors within Article 3(2). An FIE with a China subsidiary typically triggers Article 52; a foreign company with no China entity serving individuals in China typically triggers Article 53; some groups trigger both and must manage the two obligations in parallel.
Article 52: The Personal Information Protection Officer
Article 52 of PIPL provides that a processor whose processing reaches the volume prescribed by the national cyberspace authority must designate a personal information protection officer, publicly disclose the officer’s contact details, and file the name and contact with the authority. The Measures for the Administration of Personal Information Protection Compliance Audits, effective 1 May 2025, state in Article 12 that a processor of over one million individuals must designate a PIPO responsible for compliance audits. The CAC’s 18 July 2025 filing announcement adopts the same one-million threshold. In practice, “reaching the prescribed volume” means processing over one million individuals’ personal information.
The PIPO’s core function is coordination and accountability: serving as the internal point of contact for regulators and data subjects, overseeing the processor’s compliance programme, and—under the Audit Measures—owning the compliance-audit function. The officer’s name and contact must also be published in the privacy policy and on the official website, creating a public, verifiable commitment.
Article 53: Domestic Institution or Representative for Overseas Processors
Article 3(2) of PIPL extends the law’s territorial reach to processing conducted outside China where the purpose is to provide products or services to individuals within China, or to analyse or evaluate their behaviour. For such overseas processors, Article 53 requires the establishment of a dedicated institution within China or the designation of a representative, and the filing of its name and contact with the competent authority.
This is a separate role from the Article 52 PIPO. An overseas processor meeting the one-million threshold may, and often should, designate the same person as both its Article 53 representative and Article 52 PIPO—but the legal bases, filing fields and rationales differ. The Article 53 representative is the statutory touchpoint that makes an otherwise extraterritorial controller reachable by Chinese regulators and, in principle, by affected individuals. For a foreign e-commerce, SaaS or app operator with no China subsidiary, the designated representative is the single most important compliance anchor.
The 2025 CAC Filing Announcement: Online, Time-Bound, Consistent
On 18 July 2025 the CAC issued the Announcement on PIPO Information Filing. Key mechanics:
- Who files: processors of over one million individuals file with the district-level (设区的市级) cyberspace authority where they are located.
- Deadlines: a processor reaching one million from publication files within 30 working days; those already above threshold filed by 29 August 2025; material changes update within 30 working days.
- Channel: online only, via the “Personal Information Protection Business System” (https://grxxbh.cacdtsc.cn) or the CAC website’s government service hall, per the system’s first-version guide.
- Group filing: groups or affiliates may file consolidated.
- Consistency: filed data must match the official website and privacy policy—a direct cross-check.
Non-compliance is handled under PIPL and the Audit Measures.
Article 12 of the Compliance Audit Measures and the PIPO’s Audit Role
The Audit Measures (CAC Order No. 18) give the PIPO a defined statutory job. Article 12 makes the one-million-person PIPO responsible for compliance audits, linking the role to Article 54’s regular-audit duty. For processors of over 10 million, the Measures require at least one audit every two years. The PIPO thus owns a recurring, evidence-producing obligation: the audit report, remediation, and—where regulators demand—engaging a professional firm and submitting the report.
Draft Large-Platform Rules: Raising the Bar on the PIPO
The draft Large Online Platform Personal Information Protection Provisions (征求意见稿) would tighten PIPO qualifications for the largest platforms. Per the CAC expert interpretation, the PIPO must be a management member, hold Chinese nationality without permanent or long-term foreign residence, and have at least five years’ relevant experience; the role may be held concurrently with the network-data security officer. The draft would grant participation and veto rights in personal-information decisions, a direct report right to the board or top management, and require a designated working body. Although it applies only to large platforms, its design signals the direction for high-risk processors and a useful benchmark for any FIE.
How the PIPO Connects to the Rest of PIPL
The officer is not an island. The role sits at the intersection of several PIPL obligations run as a system:
- Article 51—internal management systems, procedures, classification, encryption, access control and emergency plans; the PIPO owns the programme.
- Article 54—regular compliance audits, now operationalised by the Audit Measures and the officer’s Article 12 duty.
- Articles 55–56—PIPIA. Five scenarios trigger it: sensitive personal information; automated decision-making; external entrusting, disclosure or transfer; outbound provision; and other CAC-prescribed cases. The assessment covers lawfulness, necessity, impact and safeguards, and the report and record must be kept for at least three years. The PIPO usually sponsors and files these.
- Article 57—breach notification: the processor must promptly remedy and notify the authority and affected individuals; the PIPO is the natural incident owner and Article 57 conduit.
A Landing Checklist for FIEs and Borderless Foreign Entities
For a foreign investor, the practical steps are concrete:
- Appoint the PIPO. For a China subsidiary, name a senior owner (DPO, legal or compliance) whose details are filed and published; start the 30-working-day clock at the one-million threshold, not at any inquiry.
- Assess Article 53 representative need. If the group processes Chinese data from abroad with no China entity, designate and file a domestic representative as the regulatory address—a local subsidiary, branch, or named individual/entity—and document it.
- Keep filings consistent. Business System, privacy policy and website details must match; mismatches are the easiest regulatory finding.
- Build audit and PIPIA machinery. The PIPO owns the calendar: biennial audits above 10 million, PIPIAs before high-risk processing, three-year PIPIA retention.
- Prepare breach response. Pre-authorise Article 57 notification with templates and a contact tree.
Comparison with the EU GDPR’s DPO and Representative
Foreign groups often map the PIPO onto the GDPR data protection officer (DPO, Article 37) and the Article 53 representative onto the GDPR Article 27 representative. The parallels are real but the differences matter:
- Trigger: GDPR DPO appointment turns on specific activities (large-scale systematic monitoring or special-category data) set by member states; PIPL’s PIPO turns on a clear numeric threshold (over one million individuals) plus the CAC’s prescribed-volume power.
- Filing: The GDPR has no centralized, China-style filing of DPO identity; PIPL imposes an explicit, online, time-bound filing and a published-contact requirement.
- Representative location: Both require the representative to be local—within the EU for GDPR, within China for PIPL—making an extraterritorial controller reachable.
- Independence and rights: The GDPR stresses DPO independence; China’s draft large-platform rules add management membership, veto and direct-report rights, embedding the PIPO deeper into governance than a purely advisory DPO.
The takeaway for a cross-border group is to run two registers—one for GDPR, one for PIPL—and reconcile overlaps: one person may wear both hats, but the filings, publications and duties are distinct.
Related Reading
See our PIPL overview (No. 36), the 2026 personal information protection compliance audit guide (No. 171) and App personal information compliance (No. 184) for the surrounding obligations.
《个人信息保护法》项下的个人信息保护负责人与境外处理者境内专门机构、指定代表：治理角色与报送备案义务
两类治理角色，两条法律依据
中国的《个人信息保护法》并未采用单一的合规官模式，而是清晰区分了常被外资投资者混同的两类角色。第五十二条针对达到法定处理量处理者的内部角色——个人信息保护负责人。第五十三条针对境外处理者依第三条第二款被溯及时，须设立的境内专门机构或者指定代表。设有中国子公司的外资企业通常触发第五十二条；无中国实体、向中国个人提供产品或服务或分析其行为的境外企业，通常触发第五十三条。部分集团两类情形同时触发，须并行管理两项义务。
第五十二条：个人信息保护负责人
《个人信息保护法》第五十二条规定，处理个人信息达到国家网信部门规定数量的处理者，应当指定个人信息保护负责人，公开其联系方式，并将姓名与联系方式报送履行个人信息保护职责的部门。《个人信息保护合规审计管理办法》（2025 年 5 月 1 日施行）第十二条明确，处理超过一百万人个人信息的，应当指定个保负责人，负责合规审计。国家网信办 2025 年 7 月 18 日的报送公告，亦以一百万人作为触发线。因此，实践中”达到规定数量”即指处理超一百万人个人信息。
个保负责人的核心职能是协调与问责：作为监管机关与个人信息主体的内部联络点，统筹处理者的合规体系，并依审计办法承担合规审计职责。其姓名与联系方式还须在隐私政策与官网公示，从而形成一项公开、可核验的承诺。
第五十三条：境外处理者的境内机构或代表
《个人信息保护法》第三条第二款将法律的地域效力延伸至境外处理活动：以向境内自然人提供产品或者服务为目的，或者分析、评估境内自然人行为等情形的，适用本法。对此类境外处理者，第五十三条要求在中国境内设立专门机构或者指定代表，并将其名称（或姓名）与联系方式报送主管机关。
该角色与第五十二条个保负责人相互独立；境外处理者若同时满足一百万人门槛，可指定同一人兼任两职，但法律依据、报送字段与理由各不相同。第五十三条代表是使本属域外的控制者可被中国监管机关及受影响个人触达的法定联结点。对于无中国子公司的境外电商、SaaS 或 App 运营者而言，指定代表是最关键的合规锚点。
国家网信办 2025 年报送公告：线上、限时、一致
2025 年 7 月 18 日，国家网信办发布《关于开展个人信息保护负责人信息报送工作的公告》，核心机制：
- 报送主体：处理超一百万人个人信息的，向所在地设区的市级网信部门报送。
- 时限：公告后达标的，自达标起 30 个工作日内报送；公告前已达标者于 2025 年 8 月 29 日前报送；实质性变更自变更起 30 个工作日内变更。
- 渠道：线上办理，通过”个人信息保护业务系统”（https://grxxbh.cacdtsc.cn）或中国网信网”全国网信政务办事大厅”，按系统首页第一版说明。
- 合并报送：集团或关联主体可合并报送。
- 一致性：报送信息须与官网及隐私政策一致，构成监管记录与公开披露的直接交叉核对。
未履行报送义务的，依个保法及审计办法处理，面临责令改正与处罚。
审计办法第十二条与个保负责人的审计职责
《个人信息保护合规审计管理办法》（国家网信办令第 18 号）赋予个保负责人明确法定职责。第十二条要求一百万人以上处理者指定的负责人负责合规审计，与第五十四条定期审计义务衔接。处理超一千万人者，办法设定每两年至少一次审计底线。个保负责人因此承担持续、产出证据的义务：审计报告、问题整改，以及监管要求的情形下聘请专业机构并报送报告。
大型平台规定征求意见稿：抬高个保负责人门槛
《大型网络平台个人信息保护规定（征求意见稿）》拟对最大型平台显著提高个保负责人的任职与职权要求。据国家网信办专家解读，征求意见稿拟要求负责人由管理层成员担任，具中国国籍且无境外永久或长期居留许可，具备五年以上相关从业经历，可与网络数据安全负责人兼任；拟赋予其在个人信息保护决策中的参与权与否决权、向董事会或高管直接报告权，并应明确个人信息保护工作机构。虽仅适用于大型平台，其设计揭示了高风险处理者的演进方向，亦为外资企业搭建治理架构提供参照。
个保负责人与《个人信息保护法》其余制度的衔接
该负责人并非孤立存在，而是处于处理者须系统运转的多项义务的交汇点：
- 第五十一条——内部管理制度、操作规程、分类、加密、访问控制与应急预案，个保负责人统筹该体系。
- 第五十四条——定期合规审计，现由审计办法与负责人第十二条职责落地。
- 第五十五至五十六条——个人信息保护影响评估（PIPIA）。五类情形触发：处理敏感个人信息；利用自动化决策；委托、对外提供、转让个人信息；向境外提供个人信息；以及国家网信部门规定的其他情形。评估须涵盖处理的合法性、必要性、影响及保护措施，评估报告与记录至少保存三年。个保负责人通常牵头并归档。
- 第五十七条——泄露通知。发生个人信息安全事件的，处理者须及时补救并通知监管机关与受影响个人。个保负责人是天然的事故 owner 与第五十七条通知通道。
外资企业及无境内实体境外企业的落地清单
对外国投资者，落地步骤具体：
- 指定个保负责人。 中国子公司应指定具名高级 owner（数据保护、法务或合规），其信息须报送并公示；30 个工作日时限自达标起算，而非自监管问询起算。
- 评估第五十三条代表需求。 若集团无中国实体而从境外处理中国个人数据，须指定并报送境内代表作为监管收件地址——本地子公司、分支机构或具名个人/实体，并留存任命文件。
- 保持报送一致。 业务系统、隐私政策与官网信息须一致；不一致是监管最易发现的瑕疵。
- 搭建审计与 PIPIA 机制。 个保负责人持有时间表：超一千万人每两年审计，高风险处理前 PIPIA，记录保存三年。
- 预备泄露应对。 预先授权依第五十七条通知，备好模板与联络树。
与欧盟 GDPR 的 DPO 及代表制度对照
外资集团常将个保负责人对应 GDPR 的数据保护官（DPO，第三十七条），将第五十三条代表对应 GDPR 第二十七条代表。相似性真实存在，但差异同样关键：
- 触发条件： GDPR 的 DPO 由成员国设定的特定活动触发（大规模系统性监控或大规模特殊类别数据）；个保负责人由明确的数量门槛（超过一百万人）加国家网信部门规定数量权触发。
- 报送： GDPR 无向中国式的、向监管机关集中报送 DPO 身份的制度；个保法施加了明确的线上、限时报送及公开联系方式义务。
- 代表所在地： 二者均要求代表本地化——GDPR 在欧盟境内，个保法在中国境内——使本属域外的控制者可被触达。
- 独立性与职权： GDPR 强调 DPO 的独立性与不受指令；中国大型平台征求意见稿增设管理层成员、否决权与直接报告权，将个保负责人更深地嵌入治理，而非仅具咨询性质。
对跨境集团而言，应维护两套登记——一套 GDPR、一套个保法——并统筹重叠部分：同一人可兼任两职，但报送、公示与职责彼此独立。
相关阅读
可参阅本站个保法总论（编号 36）、2026 个人信息保护合规审计指引（编号 171）与 App 个人信息合规（编号 184），了解周边义务。
Sources
- 国家互联网信息办公室 — 《关于开展个人信息保护负责人信息报送工作的公告》（2025-07-18，线上报送、30 个工作日、合并报送、一致性要求）
- 国家互联网信息办公室 — 《个人信息保护合规审计管理办法》（令第18号，第十二条个保负责人、5月1日施行）
- 国家互联网信息办公室 — 专家解读《大型网络平台个人信息保护规定（征求意见稿）》（个保负责人任职资格与职责权限）
- 中国网信网 — 全国网信政务办事大厅 / 个人信息保护业务系统入口
- 个人信息保护业务系统（个保负责人信息报送）
- 贵阳市花溪区人民政府 — 个人信息保护政策法规问答（第52条、审计办法第12条、2025年7月18日报送公告）
- 全国人民代表大会 — 《中华人民共和国个人信息保护法》