1. Identify the right being exercised
Article 45 of the PRC Personal Information Protection Law (PIPL) gives individuals rights to access and copy their personal information, subject to its stated exceptions. Article 4 covers information relating to an identified or identifiable person recorded electronically or otherwise, excluding anonymized information. The review can therefore include paper and digital HR records. Leaving employment does not itself remove these rights over personal information the employer still processes.
Start with the information actually requested, not just the label “personnel file.” Access to one’s personal information does not automatically mean unrestricted copies of every company document mentioning that person. This article concerns ordinary employer-held HR information; formally administered personnel archives require a separate review of the applicable archive rules. Also check independent document duties: Article 16 of the Labor Contract Law requires employer and employee each to hold a copy of the employment contract.
2. Verify identity without creating an obstacle
Log the request, receipt date, contact channel and responsible person. Use an existing reliable channel where appropriate; if an agent applies, check identity and authority. Under PIPL Articles 6 and 51, verification should be necessary and secure. Do not routinely demand a fresh identity-document copy, facial scan or unrelated information where a less intrusive check is sufficient. Confirm a safe delivery address, especially after the employee’s work account has closed.
Article 23 of the Network Data Security Management Regulations requires timely acceptance of personal-information rights requests, convenient methods and no unreasonable conditions restricting reasonable requests. Clarifying dates, systems or record categories may help locate the information, but should not become a reason to ignore a recognizable request. Do not condition access on explaining a litigation strategy, withdrawing a complaint or signing a general waiver.
3. Search across the actual HR record holders
Map the relevant records across HR, payroll, attendance, appraisal and the business teams that hold responsive information. Assess relevant emails or investigation material by their actual content rather than excluding a whole category as internal. Identify which entity determines the processing purposes and methods. The fact that a group company or payroll provider stores a record does not by itself answer who must respond.
For entrusted processing, PIPL Articles 21 and 59 require appropriate arrangements and assistance with the processor’s statutory duties. Ask the vendor for the relevant search or export through the agreed secure process. Where entities jointly determine processing, Article 20 says their internal allocation does not prevent an individual exercising rights against any joint processor. Record the searches and any genuine gaps; do not invent records or delete information to frustrate a pending request. Review overseas access separately before circulating HR files to headquarters.
4. Separate mixed information and test any refusal
A payroll sheet may combine the requester’s pay with colleagues’ bank details; an appraisal may contain both an assessment of the requester and unrelated information about another person. Review whether a scoped copy, extract or redaction can provide the requester’s personal information meaningfully while protecting others. PIPL Article 51 requires safeguards against unauthorized access and disclosure. Redaction should protect a specific interest, not make the response unintelligible.
Article 45 expressly refers to the exceptions in Article 18(1) and Article 35. These concern confidentiality or non-notification prescribed by laws or administrative regulations, and the relevant state-organ context; they do not create a general private-employer exception for confidential HR files. Identify the specific legal ground for any withheld information and explain the decision as Article 50 requires. An employment dispute alone is not a blanket access exception. Court or arbitration evidence-production duties must also be assessed separately.
5. Respond promptly and keep a reviewable record
PIPL Article 45 requires timely provision and Article 50 requires a convenient request mechanism; Article 23 of the Regulations also requires timely acceptance. These provisions do not set a universal 30-day response period for every employer request. Check applicable special rules and commitments, assign an internal target and escalate delays. A progress message is not a substitute for providing the information or a legally supported response. Explain any refusal and the contact route for follow-up; Article 50 allows the individual to bring proceedings in court following refusal.
Keep the request, proportionate verification record, system map, search log, supplied version, redaction or refusal reasons and delivery evidence. A correction or deletion request needs its own assessment under PIPL Articles 46–47: verify disputed accuracy, and check the deletion grounds and the exception for unexpired statutory retention or technical difficulty. For an initial consultation, provide a non-confidential outline of the employing entity, city, requested records and intended response. Lawyer consultations are in Chinese and English.
Legal sources
Official sources · Checked 2026-10-28. Translations are for reference and are not official legal texts.
- PRC Personal Information Protection Law ↗
Articles 4, 6, 18, 20–21, 35, 45–47, 50–51 and 59: access, exceptions, assistance, correction and safeguards.
- Network Data Security Management Regulations, State Council Order No. 790 ↗
Articles 2, 23, 62 and 64: scope, convenient requests and commencement on 1 January 2025.
- PRC Labor Contract Law (2012 amendment) ↗
Article 16: employer and employee each hold a copy of the employment contract.
General information about mainland China. The facts, applicable dates and local rules require individual review.
Partner, Beijing ChangAn Law Firm
China-qualified since 2019 · Beijing & Shenzhen
Review an employee HR data request
Review the scope, information holders, redactions and proposed response before sending HR records.
Discuss your matter ↗