GAC Group said it has become the first Chinese carmaker to secure a Vehicle Data Security Management System Certification, a company-level credential aimed at how an automaker runs data protection across its operations.
The certificate was issued by CATARC Certification Co., Ltd on Dec 24. China Automotive Technology and Research Center (CATARC), formed in 1985, is a state-owned enterprise that provides independent testing, certification, standards development, and technical research services for the automotive industry.
In its announcement, GAC linked the certification to GB/T 44464-2024, a recommended national standard that sets general requirements for vehicle data, including personal information protection, “important data” protection and audit and test requirements.
The standard was issued and implemented on Aug 23, 2024.
Put simply, the certification is meant to judge whether a company has a workable system for controlling vehicle data from end to end, rather than checking a single model in isolation.
GAC said the assessment covered areas such as organisational structure, internal processes, technical safeguards and coordination across the supply chain.
The automaker also pointed to recent “national-level” compliance testing for two models, the Hyptec HL and the all-new S7.
GAC said the vehicles met five requirements, including anonymising facial information captured outside the vehicle, handling in-cabin data processing, not collecting cockpit data by default, giving explicit notice when personal information is processed, and applying an appropriate precision scope.
The push comes as Chinese regulators continue to tighten expectations for connected vehicles, which can collect and transmit location, camera feeds and other sensitive information.
China’s Automobile Data Security rules for trial implementation took effect on Oct 1, 2021, setting sector-specific requirements around automotive data processing.
Separately, industry references also point to GB 44495-2024 as a cybersecurity standard with phased deadlines, including Jan 1, 2026 for new vehicle types and Jan 1, 2028 for the new registration of already type-approved vehicle types.
GAC said it plans to keep strengthening its data security work and cooperate with partners to build a more trustworthy environment for intelligent connected vehicles.
