Using Facial Recognition in China – New Guide on Filing with Local CAC

China’s cyberspace administration have issued a new guide to help companies processing and storing certain volumes of facial recognition data register with the local cyberspace authorities, as required in a recent set of rules on the use of the technology in China. The new guidelines provide a grace period for companies that hit the threshold for mandatory registration before the rules came into effect on June 1. We explain the latest regulations on the use of facial recognition in China.

On March 30, 2025, the Cyberspace Administration of China (CAC) issued a notice clarifying filing requirements for companies that use facial recognition technology to process and store facial data of a certain number of individuals.

Find Business Support

Protect your business investments in Asia with our comprehensive cybersecurity solutions.

The notice is supplementary to a new set of regulations on the use of facial recognition technology released on March 21, 2025, by the CAC and the Ministry of Public Security (MPS). These measures, called the Security Management Measures for the Application of Facial Recognition Technology (“Security Administration Measures”), which came into effect on June 1, 2025, are designed to safeguard the personal information rights of individuals while ensuring that the technology is applied responsibly and lawfully. 

The notice provides a transition period for companies that reached the threshold of storing facial recognition data for over 100,000 individuals before June 1, 2025, thereby easing the immediate compliance burden. 

Separately, the CAC has also formulated a guide for companies to complete the registration procedures, which includes detailed instructions on the materials required and how to complete the online registration.

Filing requirements for companies storing facial recognition information 

Under Article 15 of the Security Management Measures, companies that store facial recognition data of over 100,000 individuals are required to register with the provincial-level cyberspace administration within 30 working days from the date this threshold is reached. However, to ease the transition, the recent notice provides an extended deadline for companies that reached this threshold before June 1, 2025. 

Registration deadlines are as follows: 

• On or after June 1, 2025: Companies must complete registration within 30 working days from the date facial recognition data reaches 100,000 individuals.
• Before June 1, 2025: Companies must complete registration by July 14, 2025. 

Moreover, the notice stipulates that if there is a material change in the registered information, the company must update the registration within 30 working days from the date the change occurs. 

If the use of facial recognition technology is discontinued, the company must complete the cancellation of the registration within 30 working days from the termination date, and handle the collected facial information in accordance with applicable laws and regulations. 

How to register with the cyberspace administration 

Find Business Support

Our Information Systems team can help you deploy ERP or localize your global system to ensure compliance with China's data laws.

The notice also clarifies that the registration procedures can be completed online by visiting the Personal Information Protection Business System (个人信息保护业务系统). The registration must be done in accordance with the Instructions for Filling in the Facial Recognition Technology Application Filing System (First Edition) (“Filing Instructions”), which can be downloaded from this website. Alternatively, companies can access the Personal Information Protection Business System via the National Cyberspace Administration Government Affairs Hall (全国网信政务办事大厅) column on the CAC homepage. 

The Filing Instructions states the following materials must be submitted when completing the online registration: 

1. A digital version of the Basic Information Form of Personal Information Processor (template provided in the Filing Instructions, Attachment 1);
2. A digital version of the Facial Recognition Technology Application Record Form (template provided in the Filing Instructions, Attachment 2);
3. A digital version of the Personal Information Protection Impact Assessment (PIPIA) (template provided in the Filing Instructions, Attachment 3);
4. A scanned copy of the original or a photocopy of the Unified Social Credit Code Certificate (stamped with official seal);
5. A scanned copy of the legal representative’s or the responsible person’s ID document;
6. A scanned copy of the agent’s ID document;
7. A scanned copy of the Power of Attorney for the agent (stamped with official seal) (template provided in the Filing Instructions, Attachment 4);
8. A scanned copy of the Letter of Commitment (stamped with official seal) (template provided in the Filing Instructions, Attachment 5); and
9. Scanned copies of other relevant materials. 

Companies must first register an account on the Personal Information Protection Business System before being able to log in and upload the above documents.

The materials will be checked within 15 working days from the date of their submission. Companies can see whether the documents have been accepted by viewing the “Status” column, which will display either “Filing Completed”, “Returned for Improvement”, or “Review Failed”, depending on the results of the material inspection.

“Filing Completed” means the registration procedures have been successful. If the status shows “Return for Improvement”, the applicant must provide the required supplementary materials within 10 working days. If the applicant fails to supplement the materials within the time limit, the filing procedure will be terminated. 

If the status shows “Review failed”, it means the materials have not met the requirements and the registration procedure will be automatically terminated.

Conducting a PIPIA 

Related Reading

China's Tightened Facial Recognition Regulations: Key Business Takeaways

Under China’s Personal Information Protection Law (PIPL), companies that engage in certain personal information processing activities are required to carry out a PIPIA. The contents of the PIPIA depend on the type and scope of processing activity, but generally include assessing whether the purposes for and methods of processing personal information are legal, legitimate, and necessary, the potential impact on personal rights and security risks, and whether the protective measures taken to protect personal information are legal, effective, and commensurate with the level of risk. 

The Filing Instructions have provided a specific template for conducting a PIPIA for facial recognition information processing. The template largely includes the same requirements for assessing personal information protection measures and other legal compliance procedures, but also requires companies to disclose: 

• Basic technical specifications
• Collection, use, and storage of personal (facial) data
• Standard operating procedures for data input, facial recognition, result processing, data storage, risk response, and confidentiality
• The purpose, method, and legal/ethical basis for collecting facial data
• The use of facial data for automated decision-making
• Details about storage infrastructure, platforms, and technology providers 

Easing the transition for companies 

The notice reflects the government’s effort to strike a balance between regulatory enforcement and practical implementation. By offering a grace period for companies that reached the data threshold before June 1, 2025, and providing detailed guidance through the Filing Instructions, the authorities are helping businesses navigate compliance without unnecessary disruption to operations.

• Previous Article How Expats in Shenzhen Can Apply for the GBA IIT Subsidy in 2025?
• Next Article China’s Visa-Free Policies: Latest Updates