Data:China
1. Overview
The Personal Information Protection Law (PIPL) came into effect on 1 November 2021, much later than the General Data Protection Regulation (GDPR) which came into force on 24 May 2016. PIPL is China’s primary legal framework for personal information protection and has notable parallels with the GDPR, while reflecting distinctly Chinese regulatory priorities.
2. Key Terms and Definitions in the PIPL are as follows
PIPL Article 2: “The personal information of natural persons shall be protected by law. No organization or individual may infringe upon natural persons’ rights and interests on their personal information.”
Personal information processor (Article 73(1)): “any organization or individual that independently determines the purpose and method of processing personal information.” The term personal information processor is functionally equivalent to the GDPR concept of a data controller.
Personal information (Article 4): “information related to an identified or identifiable natural person, recorded electronically or by other means, excluding anonymized information.”
3. The Scope of PIPL
PIPL applies to the processing of personal information of natural persons within China (Article 3), while also having explicit extraterritorial reach, applying to processing outside China where:
- the purpose is to provide products or services to persons within China;
- the purpose is to analyze or assess the behavior of persons within China; or
- other circumstances provided by law or administrative regulations apply.
4. Data Portability under PIPL Article 45
Article 45 of the PIPL sets out China’s primary data-portability terms:
“Individuals have the right to access and copy their personal information from personal information processors, except where laws or administrative regulations provide otherwise. Where an individual requests access to or copying of personal information, the personal information processor shall provide it in a timely manner.
Where an individual requests the transfer of personal information to a personal information processor designated by the individual, where the conditions set by the national cyberspace authority (hereon abbreviated as “CAC”) are met, the personal information processor shall provide a means for such transfer.”
When the scope of Article 45 of the PIPL is reviewed, it is seen that the data portability right:
- - applies to all personal information processors;
- - has no size threshold or gatekeeper designation, whereby a small enterprises to large platforms are, in principle, equally subject to the provision;
- - is limited to personal information;
- - does not encompass non-personal data, including machine-generated, anonymized and IoT data.
- - not confined to processing based on consent or contract (until the DSMR clarified, as elaborated below),
- - not expressly limited to data “provided by” the individual (until the DSMR clarified, as elaborated below)
At first, the PIPL was construed to be vague in terms of this data portability clause, since the data portability conditions were awaited to be announced by CAC. The conditions referred to in PIPL Article 45 have since been elaborated in Article 25 of the Network Data Security Management Regulations (DSMR), (Official English Ministry of Justice text) promulgated by the State Council on 30 September 2024 and effective from 1 January 2025. The Regulations are a State Council administrative regulation, not an instrument issued solely by the CAC. They nonetheless respond to PIPL Art. 45’s reference to conditions set by the CAC and operate within China’s broader CAC-centred data-governance framework.
Article 25 is widely understood as implementing and further specifying the PIPL’s data-portability right. Nonetheless, the provision does not itself establish a fully mature interoperability regime comparable to the EU framework: further technical standards, procedural guidance, and enforcement practice remain relevant to the right’s practical exercise.
DSMR Article 25 reads as follows:
“For requests for transferring personal information that meets the following conditions, a network data processor shall provide means for other network data processors designated by the individual to access and obtain relevant personal information:
(1) the true identity of the requester can be verified;
(2) the requested transfer involves personal information provided with the individual's consent or collected based on a contract;
(3) the transfer of personal information is technically feasible; and
(4) the transfer of personal information does not harm the legitimate rights and interests of others. Where the number of transfer requests significantly exceeds a reasonable limit, the network data processor may charge necessary fees based on the cost of transferring personal information.”
Lack of Direction in Implementation
Implementation is lacking, although lawyers’ commentary describes Article 25 as an “expansion and further specification” of the portability right under PIPL Art. 45.
Article 25 of the DSMR does not by itself create a fully mature interoperability regime. Further CAC rules, technical standards, transfer formats, authentication procedures, and enforcement practice may still be needed for the right to operate consistently in practice. We distinguish between: (1) the existence of regulatory conditions, which Article 25 of the DSMR supplies; and (2) complete operational implementation, which remains dependent on technical and administrative development.
5. Implementation and Case Law
We identified no published Chinese judgment directly applying the transfer right in PIPL Art. 45(3). Indeed, Courts have addressed portability indirectly, mainly through unfair competition law. On 28 August 2025 the Supreme People's Court, released their first batch of guiding cases devoted to data rights. Two of these stand out in terms of data portability, and are discussed below, although the rulings are not based on data portability provisions under the PIPL:
- Guiding Case No. 263: The case concerned a dispute between two recruitment platforms and was decided before the PIPL entered into force, on the basis of Art. 2 of the Anti-Unfair Competition Law. The court held that a platform which, with the user's authorization, transfers data that user obtained on another platform does not engage in unfair competition, provided it does not disrupt market order. The original platform holds protected interests in data it has invested in, but it may not prevent users from transferring data they lawfully hold.
- Guiding Case No. 262, states that unauthorized scraping that substantially replaces the original platform's service is unfair competition.
In a judgment of 8 September 2023, the Guangzhou Internet Court held that the rights to be informed and to decide are the core personal information rights, whereas the rights of access, copy, portability, correction, supplementation and explanation are instrumental rights. This case pertained to the necessity of the personal information processor’s (in GDPR terms, data controller’s) transfer of data abroad. Albeit not being directly related to data portability, this case classified data portability as a supplementary right.
Overall, there is no evidence yet that the individual transfer right works in practice. Data portability in China has so far been developed by the courts and framed by competition and data-circulation concerns rather than by data protection.
In their article “From brussels effect to gravity assists: Understanding the evolution of the GDPR-inspired personal information protection law in China”, Wenlong Li and Jiahong Chen have stated that there is much space left for local courts to decide on the nature, scope and impact of data portability rights on a case-by-case basis. It should be noted, as a significant caveat, that there exists a scant corpus of case-law, and the few decisions that are publicly accessible are inadequate to form a coherent pattern.
Despite the interpretative powers granted by the PIPL to the CAC, the authority remains relatively passive in elucidating and detailing the provisions of the PIPL through official guidelines.
6. Public and Private Sector
PIPL applies to both public and private sector processors.
State organs are specifically addressed in Articles 33 through 38 of the PIPL and receive some exemptions, such as the absence of a consent requirement where processing is necessary to perform statutory duties or obligations. PIPL’s Article 45 on data portability does not expressly exclude state organs, but has a very broad general carve-out “except where laws or administrative regulations provide otherwise”. In terms of setting out a broad exception regime, this article may be construed as similar to the exceptions under GDPR Article 23 (this subject as a topic exceeds the scope of this research).
7. Related Legislation: Data Security Law (DSL, 2021)
The DSL classifies data into tiers: general, important, and core national data. It imposes corresponding security obligations. It contains no portability right. Restrictions on cross-border transfers of “important data” may limit the practical exercise of portability. We will not delve into this piece of legislation and its application, as it vastly remains outside the scope of this research.
A related legislative framework is also encountered in Article 9 of the 2022 Anti-Monopoly Law, providing that undertakings must not use data and algorithms, technology, capital advantages, platform rules, or similar means to engage in monopolistic conduct prohibited by the law.
8. Comparison of the Chinese Data Portability Regime with the EU Data Portability Regime
- ' 'The EU
The EU portability right originated in Article 18(1) of the draft GDPR as a way to facilitate switching between online services, although the final provision narrowed its scope. GDPR’s Article 20 gives individuals more control over personal data and can support data flows within the EU by enabling the provision of a copy of personal data or a direct transfer between controllers.
The scope of the GDPR based data portability right encompasses the following:
- personal data processed on the basis of consent or a contract:
- non-personal data falls outside the scope of the GDPR entirely,
- the right applies to SMEs as well as large technology firms (similar to the Chinese scope).
- the right is free of charge and may be exercised at any time (subject to limits such as deletion/anonymization of the data, interference with a public-interest task, and the rights and freedoms of others).
The EU’s Article 29 Working Party Guidelines on the right to "data portability" shed light on the application and intent of the data portability right, as quoted below:
“It allows for data subjects to receive the personal data that they have provided to a controller, in a structured, commonly used and machine-readable format, and to transmit those data to another data controller. The purpose of this new right is to empower the data subject and give him/her more control over the personal data concerning him or her. Since it allows the direct transmission of personal data from one data controller to another, the right to data portability is also an important tool that will support the free flow of personal data in the EU and foster competition between controllers. It will facilitate switching between different service providers, and will therefore foster the development of new services in the context of the digital single market strategy.”
Comparative analysis of GDPR and PIPL:
Compared with the EU framework, China’s Article 25 is a significant move from a high-level statutory portability clause toward specified regulatory conditions. Yet the availability of concrete technical standards and consistent enforcement remains a central practical question.
As identified by Wenlong Li and Jiahong Chen:
“unlike the EU's cherishment of data protection as a freestanding, fundamental right, China's placement of personal information protection as a legally protectable interest in its legal order is further down the legal hierarchy to such an extent that its legal position has significantly affected how personal information protection is balanced against other rights and interests. Particularly relevant rights include the right to conduct a business (not formulated explicitly in China), economic growth, as well as cyber sovereignty. Personal information protection, even combined with the right to privacy, has never been elevated to the highest level of hierarchy as a fundamental or constitutional right in China.”
“…China navigates through a patchwork of internal considerations, international standards, and strategic choices, ultimately sculpting a data protection regime that has a similar appearance to the GDPR but aligns with its distinct political, cultural and legal landscape.”
“Unlike the US, China is not a major exporter of digital services to the EU, which gives the country a much weaker incentive to align its data privacy law in an attempt to facilitate the free flow of personal data from the EU.”
In light of these valuable considerations, it is concluded that in the EU, data protection is recognized as an autonomous fundamental right. In China, by contrast, personal information protection is treated as a legally protected interest, which places it much lower in the legal hierarchy. This weaker status shapes how it is weighed against competing considerations, such as the freedom to conduct a business, economic development and cyber sovereignty. Neither personal information protection nor the right to privacy, whether taken separately or together, has ever been raised to the rank of a fundamental or constitutional right in China. China's approach results from a combination of domestic priorities, international models and strategic decisions. The outcome is a data protection framework that looks similar to the GDPR on the surface but is adapted to China's own political, cultural and legal context. Unlike the United States, China exports few digital services to the EU. It therefore has much less reason to bring its data protection law into line with EU standards in order to secure the free flow of personal data from Europe.
- Portability of Non-personal data
- China has no direct equivalent to the EU Data Act’s internet of things data portability regime.
- National security is at the forefront of considerations playing into information transfers abroad.
- Unlike the EU legislation’s motto of “free flow of data in the internal market”, China is guarding sovereignty concerns when thinking of the transfer of data.
While data transfers outside of China should not be confused with the general right to data portability, the interplay between the two could be considered. A limitation, or a lack in the adoption of the right to data portability results in less flow of data both within China, and outside of China. While data transfers abroad do not form part of this exercise, it should also be noted that the main driving factor of EU’s data protection regime is the free flow of information within the internal market, while China does not take part in such a union and is therefore not incentivized by such a market goal.