PIPL’s rights chapter looks familiar to anyone who has run a GDPR rights program: know, access, copy, correct, delete, port. The differences sit at the edges, and two of them are genuinely novel: relatives inherit rights over a deceased person’s data, and algorithmic price discrimination is banned as a rights matter. For operators, the practical work is the same as in Europe: a request channel that works, identity verification, and deletion logic wired to real retention rules.
| Regulation | PIPL Chapter IV (Articles 44-50) |
|---|---|
| Max penalty | RMB 50M or 5% of prior year’s turnover |
| Enforcing authority | CAC |
| Court route | Article 50: refusals are directly actionable |
The rights, article by article
Know and decide (Article 44). The umbrella right: individuals may know about and decide on processing, and restrict or refuse it, except where law requires otherwise.
Access and copy (Article 45). Individuals can consult and copy their personal information, promptly provided, plus the portability channel to a designated handler where CAC conditions are met.
Correction (Article 46). Inaccurate or incomplete data must be corrected or completed after verification.
Deletion (Article 47). Request-based and proactive: purposes achieved, retention expired, service shuttered, consent withdrawn, or unlawful processing all trigger deletion without being asked. This proactive duty is stricter in form than GDPR Article 17 and turns retention schedules into deletion pipelines.
Automated decisions (Article 24). Decisions via automated processing must be transparent, fair, and just; no unreasonable differential treatment on price or terms (the anti-”big data killing familiarity” rule); marketing pushes need a non-personalized alternative; and decisions with a major effect on rights carry explanation and refusal rights. Compare the EU Article 22 regime.
Deceased persons (Article 49). Close relatives may access, copy, correct, and delete the deceased’s information for their own lawful and legitimate interests, absent contrary arrangements made by the deceased.
Enforcement lever (Article 50). Handlers must establish convenient mechanisms and explain refusals, and individuals can sue over refusals directly, no regulator complaint needed first.
Building the program
Route Chinese requests through the same DSAR machinery you run for GDPR, with three China additions: a verified-relative flow for deceased-person requests, deletion triggers wired to consent withdrawal and service termination events, and the recommendation-algorithm off switch on consumer surfaces. Consent quality upstream determines rights load downstream, per the PIPL consent guide, and the full compliance sequence lives in the PIPL roadmap.