GB/T 46901-2025Data security technology - Requirements for personal information transfer at the request of the personal information subject (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part

1.Structure and Drafting Rules of Standardization Documents". Drafting. This document was proposed and is under the jurisdiction of the National Cybersecurity Standardization Technical Committee (SAC/TC260). This document was drafted by: Beijing Institute of Technology, Beijing Electronic Science and Technology Institute, China Electronics Technology Standardization Institute, and Beijing CESI Technology Development Co., Ltd. Exhibition Limited Liability Company, Sangfor Technologies Inc., Beijing Shangyin Technology Co., Ltd., Beijing Baidu Netcom Technology Co., Ltd., Beike Zhaofang (Beijing) Technology Co., Ltd., Shenzhen National Financial Technology Evaluation Center Co., Ltd., China United Network Communications Group Co., Ltd. Guangzhou Rootchain International Network Research Institute Co., Ltd., Beijing DataSafe Technology Co., Ltd., Alibaba (Beijing) Software Service Co., Ltd. China Academy of Cyberspace Studies, National Computer Network Emergency Response Technical Team/Coordination Center, China Academy of Information and Communications Technology, Beijing Hanhua Feitian Information Technology Co., Ltd. An Technology Co., Ltd., CESI (Shenzhen) Electronic Information Product Standardization Engineering Center Co., Ltd., Yunnan Power Grid Co., Ltd., CRRC Chang Spring Rail Transit Vehicle Co., Ltd., China Southern Power Grid Digital Enterprise Technology (Guangdong) Co., Ltd., and the Ministry of Science and Technology's Science and Technology Talent Exchange and Development Service Center Center, Qi An Xin NetGod Information Technology (Beijing) Co., Ltd. The main drafters of this document are. Hong Yanqing, Wang Ding, Zhu Xuefeng, He Yanzhe, Chen Tian, Zhang Chao, Song Botao, Zhang Renzhuo, Ding Xiaoqiang, and Wang Jingzhou. Sun Shuo, Lu Bing, Xian Yujie, Wu Zushun, Luo Feng, Cao Mi, Tao Ye, Liu Dong, Zhang Hanzhuo, Tong Panying, Liu Yuhong, Gu Wei, Liu Aijing, Jiang Wei, Wang Pu, Wang Wenlei, Ge Xin, Peng Gen, Liu Dandan, Liu Jincai, Sun Shiyu, Liu Haoxin, Hu Jian, Wang Jingli, Du Haowen, An Jincheng. Data security technology Request for transfer of personal information based on personal request

1 Scope

GB/T 46901-2025 is the Chinese national standard covering data portability - a person asking one service to hand their data to another, with the identity verification, the scope of what must be transferred, the format, the timescale and the grounds on which a request may be refused. First edition, and it is the Chinese counterpart of the portability right. It was issued on 31 December 2025 and has been in force since 1 July 2026, as a first edition. The document is under the responsibility of the Standardization Administration of China. This page is published from the official record of the 2025 edition; the clause text of a standard this recent is not yet in circulation, and the figures, limits and tables it contains are those of the document itself, delivered in full with the English translation.

This document specifies the scope of application, prerequisites, procedural requirements, and specific circumstances for the transfer of personal information based on the request of the personal information subject. Other requirements for shape. This document serves as a guide for personal information processors in responding to requests from personal information subjects to transfer their personal information, and also provides guidance for regulatory authorities and third parties. This provides a reference for the relevant supervision, management, and evaluation activities of the evaluation agency.

2 Normative references

The contents of the following documents, through normative references within the text, constitute essential provisions of this document. Dated citations are not included. For references to documents, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies. This document.

GB/T 25069-2022 Terminology for Information Security Technologies

GB/T 35273-2020 Information Security Technology - Personal Information Security Specification

3 Terms and Definitions

The terms and definitions defined in GB/T 25069-2022 and GB/T 35273-2020, as well as the following terms and definitions, apply to this document.

3.1 A data subject requests that the processor handling their personal information transfer the processed information to another entity designated by the data subject. The process of personal information processors.

3.2 New data related to an individual, derived from the analysis, calculation, and processing of personal information.

Note. This data may differ from the original data, but it is still personal information and retains its personal association characteristics.

3.3 Requester The entity that initiates the request for the transfer of personal information.

Note. This includes the individual who owns the personal information, the individual's guardian, and the trustee who initiates the transfer request on behalf of the individual.

3.4 structured A data organization method that has certain rules, formats, or patterns, enabling software to extract specific elements of the data. Note

1.In a spreadsheet, data is represented in rows and columns. Note

2.Structured data is typically composed of predefined schemas, templates, fields, etc., where each data element has a specific meaning and type, and follows... Specific formats, conventions, and standards are used to facilitate automatic processing and interpretation by programs such as computers.