--- title: "China — Data Subject Rights | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/china/data-subject-rights/ source_html: /jurisdictions/china/data-subject-rights/index.html description: "China — Data Subject Rights: data_subject_rights Data Subject Rights 5 sub-modules 5 claims Amber ▾ # Substantive rights are enacted and broad, but the absence of a codified statutory response deadline creates res" generated_at: 2026-10-25T04:46:50Z content_sha256: 6220202cc87c3e49a2fc556d2f2c461ce83bf1d66bfdcbd677fecce08a5af4aa generator: "fe-fleet/md-twin@1.0" --- # China — Data Subject Rights | Data Protection Monitor ### D3Data Subject Rights5 sub-modules5 claimsAmber▾# Substantive rights are enacted and broad, but the absence of a codified statutory response deadline creates residual ambiguity relative to GDPR-style regimes. Primary framework PIPL Chapter IV, Arts 44–50 Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Amber Substantive rights are enacted and broad, but the absence of a codified statutory response deadline creates residual ambiguity relative to GDPR-style regimes. #### Sub-modules (5) #### Access RightGreen Individuals have the right to access and obtain copies of their personal information, which handlers must provide in a timely fashion. Claims (1): - Under PIPL, individuals have the right to access and make copies of their personal information, and personal information handlers must provide such information in a timely fashion. #### Rectification And ErasureGreen Individuals may request correction, supplementation or updating of inaccurate/incomplete/outdated personal information, and may request deletion. Claims (1): - Individuals are entitled to correct, supplement and update incomplete, inaccurate or outdated personal information and may request deletion of their personal information from handlers. #### Restriction And ObjectionGreen Individuals may demand an explanation of automated-decision-making use and may refute decisions made solely via automated means where those decisions significantly affect them. Claims (1): - Data subjects have the right to request an explanation regarding the use of their personal information and to refute a decision made by a handler solely through automated decision-making where it significantly affects them. #### Data PortabilityGreen PIPL provides a portability right allowing individuals to request transfer of their personal information to another handler; PIPL goes further than GDPR by permitting legal claims against handlers who reject rights requests. Claims (1): - PIPL provides a right of portability whereby individuals may request that a personal information handler transfer their personal information to another handler; PIPL exceeds GDPR by granting individuals a right to bring claims against handlers who reject a rights request and a right to demand an explanation of handling rules. #### Deadlines And Response WindowsAmber PIPL requires handlers to respond to access requests 'in a timely fashion' but does not set a fixed statutory day-count deadline analogous to GDPR's one-month rule; no secondary source located specifying a harmonized numeric window across all right types. Claims (1): - PIPL requires personal information handlers to respond to access requests 'in a timely fashion' rather than specifying a codified numeric response deadline equivalent to GDPR's one-month rule. Category narrative 86 words PIPL Chapter IV grants a GDPR-adjacent rights bundle: access/copy, rectification, erasure, restriction/objection (including a right to demand explanation of and refute automated decisions), and a portability right that in some respects exceeds GDPR by allowing individuals to sue handlers who refuse rights requests and by extending exercise of rights to close relatives of deceased individuals. However, PIPL does not codify a fixed numeric response-deadline analogous to GDPR's one-month rule; the statute only requires handlers to respond 'in a timely fashion,' leaving specific windows to sectoral/CAC guidance. Evidence 5 Sources and claims (5) - Probable[IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — Under PIPL, individuals have the right to access and make copies of their personal information, and personal information handlers must provide such information in a timely fashion.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — Individuals are entitled to correct, supplement and update incomplete, inaccurate or outdated personal information and may request deletion of their personal information from handlers.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — Data subjects have the right to request an explanation regarding the use of their personal information and to refute a decision made by a handler solely through automated decision-making where it significantly affects them.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — PIPL provides a right of portability whereby individuals may request that a personal information handler transfer their personal information to another handler; PIPL exceeds GDPR by granting individuals a right to bring claims against handlers who reject a rights request and a right to demand an explanation of handling rules.observed 2026-08-03 - Uncertain[IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — PIPL requires personal information handlers to respond to access requests 'in a timely fashion' rather than specifying a codified numeric response deadline equivalent to GDPR's one-month rule.observed 2026-08-03