GB/T 45404-2025 数据安全技术 大型互联网企业内设个人信息保护监督机构要求

ICS

35.030

CCS

L80

中华人民共和国国家标准

GB/T45404—2025

数据安全技术大型互联网企业内设

个人信息保护监督机构要求

Datasecuritytechnology—RequirementsforlargeInternetcompaniesinternal

personalinformationprotectionsupervisionagency

2025-03-28发布2025-10-01实施

国家市场监督管理总局发布

国家标准化管理委员会

GB/T45404—2025

目次

前言

·····································································································

Ⅲ

1

范围

··································································································

1

2

规范性引用文件

······················································································

1

3

术语和定义

···························································································

1

4

个人信息保护监督机构的组成

·······································································

1

4.1

人员构成

·························································································

1

4.2

主任、副主任及职责

·············································································

2

4.3

秘书及职责

······················································································

2

5

个人信息保护监督机构成员

··········································································

2

5.1

外部成员的任职要求

·············································································

2

5.2

外部成员的提名与任免

··········································································

3

5.3

外部成员的履职

·················································································

4

5.4

内部成员的人选与任期

··········································································

4

5.5

内部成员的履职

·················································································

5

6

个人信息保护监督机构职责

··········································································

5

6.1

一般事项监督

····················································································

5

6.2

特别事项监督

····················································································

6

6.3

建议和意见

······················································································

7

7

个人信息保护监督机构工作机制

·····································································

7

7.1

一般要求

·························································································

7

7.2

临时会议

·························································································

8

7.3

延期开会与审议

·················································································

9

7.4

暂缓表决

·························································································

9

7.5

履职独立性保障

·················································································

9

7.6

履职条件保障

····················································································

9

7.7

工作规则制定

····················································································

9

参考文献

································································································

10

Ⅰ

GB/T45404—2025

前言

本文件按照GB/T1.1—2020《标准化工作导则第1部分：标准化文件的结构和起草规则》的规

定起草。

请注意本文件的某些内容可能涉及专利。本文件的发布机构不承担识别专利的责任。

本文件由全国网络安全标准化技术委员会（SAC/TC260）提出并归口。

本文件起草单位：中国人民大学、中国信息通信研究院、北京理工大学、中国电子技术标准化研究

院、中国网络空间研究院、国家信息技术安全研究中心、蚂蚁科技集团股份有限公司、阿里巴巴

（北京）软件服务有限公司、贝壳找房（北京）科技有限公司、北京小桔科技有限公司、北京抖音信息

服务有限公司、上海得物信息集团有限公司、北京京东尚科信息技术有限公司、北京百度网讯科技有限

公司、华为终端有限公司、北京小米移动软件有限公司、北京微梦创科网络技术有限公司、云从科技集

团股份有限公司、浙江大学、上海商汤智能科技有限公司、荣耀终端有限公司、国家计算机网络应急技

术处理协调中心浙江分中心、深圳市网安计算机安全检测技术有限公司、北京奇虎科技有限公司、启明

星辰信息技术集团股份有限公司。

本文件主要起草人：张新宝、葛鑫、陈琦、洪延青、陈特、陈湉、姚相振、卢磊、姜伟、晏慧、

何延哲、何波、王晖、田申、聂正军、白晓媛、孙铁、许锐、王海棠、郭建领、顾伟、刘艾婧、

石玉珍、朱雪峰、刘笑岑、李昳婧、张朝、彭晋、刘克、徐燕、侍敬楠、张娜、陈一夫、黄天宁、

张向拓、谷海燕、王磊、范晔、崔丽莎、覃潇霄、衣强、赵晓娜、任奎、刘楠、马俊野、潘洁、李军、

白雅喜、赵高华、姚一楠、王普、刘金飞、文龙、徐浩、梁蓉蓉、李然、李丽、杨天识、张瑶。

Ⅲ

GB/T45404—2025

数据安全技术大型互联网企业内设

个人信息保护监督机构要求

1范围

本文件规定了大型互联网企业建立和运行个人信息保护监督机构的要求，包括个人信息保护监督机

构的设置、职责、工作规则，以及个人信息保护监督机构的成员等要求。

本文件适用于大型互联网企业建立和运行个人信息保护监督机构及监管、检查、评估等活动。

2规范性引用文件

下列文件中的内容通过文中的规范性引用而构成本文件必不可少的条款。其中，注日期的引用文

件，仅该日期对应的版本适用于本文件；不注日期的引用文件，其最新版本（包括所有的修改单）适用

于本文件。

GB/T25069—2022信息安全技术术语

GB/T35273—2020信息安全技术个人信息安全规范

3术语和定义

GB/T25069—2022和GB/T35273—2020界定的以及下列术语和定义适用于本文件。

3.1

大型互联网企业largeInternetcompany

提供重要互联网平台服务、用户数量巨大、业务类型复杂的互联网企业。

3.2

个人信息保护监督机构personalinformationprotectionsupervisionagency

大型互联网企业建立的主要由外部成员组成，对自身个人信息保护合法合规情况、履行个人信息保

护社会责任情况等进行独立监督，并对提升个人信息保护水平提出建议和意见的机构。

3.3

个人信息保护监督机构外部成员externalmemberofpersonalinformationprotection

supervision

agency

具备个人信息保护专业知识和技能，与受聘大型互联网企业及其主要股东不存在可能妨碍其进行独

立客观判断的关系，对大型互联网企业个人信息保护情况进行监督，发表独立客观建议和意见，不在大

型互联网企业担任其他任何职务的外部专家。

4个人信息保护监督机构的组成

4.1人员构成

大型互联网企业个人信息保护监督机构应由七名至十五名内、外部成员共同组成，其中外部成员占

比不低于三分之二，内部成员不超过三分之一。

1