ChinaPersonal Information Protection Law, Individual Rights
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Provide a convenient channel for individuals to access, copy, correct, or delete their personal information, and to request portability to another handler where state conditions are met.
- Give a reasoned written explanation whenever a rights request is refused.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which conditions set by the national cyberspace department, described in Article 45 as 符合国家网信部门规定条件 ("meets the conditions set by the national cyberspace department"), must a request meet before a handler must provide a route to transfer personal information to another handler the individual designates?
What it makes you log
Logging duty
Articles 44 to 50 give the individual the right to know, decide, access, copy, transfer, correct, delete and obtain an explanation of the processing rules, and Article 50 requires a handler to set up a mechanism to receive and handle those requests and to give reasons for a refusal. None of them requires a log, register or record of requests or responses.
- Kind
- None
- As of
What this law does
Individuals have the right to know about and decide on processing, and to limit or refuse it (Art. 44), the right to access and copy their data including portability to another handler under state conditions (Art. 45), the right to correction or completion (Art. 46), the right to deletion in enumerated circumstances with cessation of active processing as a fallback where deletion is technically infeasible (Art. 47), and the right to an explanation of processing rules (Art. 48).
Article 50 requires a convenient exercise mechanism, a reasoned explanation for any refusal, and permits a court suit if a request is unreasonably denied.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .