The State Administration for Market Regulation and the Standardization Administration of China released three national standards under Announcement No. 38 (2025), all administered by TC260:
1. GB/T 46901—2025 Data Security Technology — Requirements for Personal Information Transfer upon Individual Request
Specifies scope, prerequisites, process requirements and special-case rules for transferring personal information upon the data subject's request — guiding processors in responding, and supporting regulators and third-party assessors.
2. GB/T 46902—2025 Cybersecurity Technology — Cyberspace Security Atlas Element Representation
Specifies element classification, coding and graphic-symbol expression for cyberspace security atlases — for regulators, industry authorities, network operators and service providers building and visualizing security atlases.
3. GB/T 46903—2025 Data Security Technology — Requirements for Personal Information Protection Compliance Audit
Sets out audit principles and the overall requirements, implementation process, content and methods for PII compliance audits — for processors and professional institutions conducting audits.
All three standards take effect on July 1, 2026.