Personal Information Protection Law, Individual Rights and Automated Decision-Making

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 November 2021.

A data subject rights rule binding public and private bodies.

As of 23 August 2026.

What it requires

Provide a convenient channel for individuals to access, copy, correct, or delete their personal information, and to request portability to another handler where state conditions are met.
Give a reasoned written explanation whenever a rights request is refused.
Ensure transparency and non-discriminatory treatment in any automated decision made using personal information, and do not use it for unreasonable differential pricing.
Offer a non-personalized option or a convenient opt-out wherever automated decision-making is used to push marketing or commercial information.
Provide an explanation and honor an individual's refusal of a decision made solely by automated means where that decision has a major effect on their rights.
Complete a personal-information-protection impact assessment before deploying automated decision-making.

Who checks it

Audit expectation

none

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Individuals have the right to know about and decide on processing, and to limit or refuse it (Art. 44), the right to access and copy their data including portability to another handler under state conditions (Art. 45), the right to correction or completion (Art. 46), the right to deletion in enumerated circumstances with cessation of active processing as a fallback where deletion is technically infeasible (Art. 47), and the right to an explanation of processing rules (Art. 48).

Article 50 requires a convenient exercise mechanism, a reasoned explanation for any refusal, and permits a court suit if a request is unreasonably denied.

Article 24 separately requires transparent, non-discriminatory treatment of automated-decision-making results, prohibits unreasonable differential pricing, requires a non-personalized option or opt-out where automated decisions push marketing, and gives an individual a right to explanation and to refuse a decision made solely by automated means where it has a major effect on their rights, with Article 55(2) requiring a personal-information-protection impact assessment before deploying automated decision-making.

When LexLint raises it

crawls_web
trains_models
processes_voice
processes_biometrics
automated_outreach
high_risk_decisions

Read the law

official CAC-published full Chinese statutory text

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app