Where a department with personal information protection duties finds, when performing its duties, relatively high risks in personal information handling activities or the occurrence of personal information security incidents, the department may hold an interview with the legal representative or the principal person in charge of the personal information handler according to the provided authority and procedures, or request the handler to entrust a professional institution to conduct compliance audits of the personal information handling activities. The personal information handler shall adopt measures to make rectification and eliminate potential risks as required.
Where a department with personal information protection duties, in performing its duties, finds an illegal personal information handling activity that may involve a crime, the department shall transfer the case to the public security organ in a timely manner in accordance with the law.
Related provisions: