Data Breach Response in China

Data breach response in China: the core obligations

Data breach response in China is now a matter of hours, not days. Since 1 November 2025, the Cyberspace Administration of China (CAC) Administrative Measures for National Cybersecurity Incident Reporting have required network operators to grade every incident and, if it reaches the "relatively major" level or above, to report it within four hours to the provincial cyberspace authority. Critical information infrastructure (CII) operators have one hour. At the same time, the Personal Information Protection Law (PIPL) requires immediate remedial measures and notification of the regulator and, in most cases, the affected individuals.

The amended Cybersecurity Law, adopted on 28 October 2025 and in force from 1 January 2026, raised the stakes further. Maximum fines for breaches of general security obligations rose sharply, first-time violations became directly finable, and the law expressly links network operators' handling of personal information to the Civil Code and the PIPL. It also provides that penalties should be mitigated where a company corrects harm voluntarily, cooperates with investigators or discloses violations the regulator did not know about. Fast, accurate reporting is therefore both a duty and a mitigation strategy.

For a foreign-invested enterprise or a multinational with Chinese operations, the practical consequence is clear. An effective data breach response has to run on a Chinese clock and a global clock simultaneously, with decisions about grading, reporting and data sharing made by people who are authorised to make them within the first hour.

The legal framework for incidents and breaches

Several layers of law apply to a single incident, and the primary texts are available on the national laws and regulations database and the CAC website. None of them can be read in isolation, and the most common error is to treat a breach as a pure privacy matter when it is also a network security and, sometimes, a data security or criminal matter.

• Cybersecurity Law (as amended, effective 1 January 2026). Requires network operators to maintain emergency plans, take remedial action and report incidents to the competent authorities. The amendment increased fines and broadened extraterritorial reach to any overseas activity that endangers China's network security.
• Data Security Law (2021). Requires data processors to take immediate measures when a data security incident occurs, inform users promptly and report to the competent authorities.
• Personal Information Protection Law (2021). Article 57 requires a personal information processor to take remedial measures immediately when personal information is, or may have been, leaked, tampered with or lost, and to notify the regulator and the individuals concerned.
• Regulations on Network Data Security Management (effective 1 January 2025). Require emergency response plans, notification of affected parties by phone, text, email or public notice, and reporting in accordance with law.
• National Cybersecurity Incident Reporting Measures (effective 1 November 2025). Set the grading guide, the reporting deadlines, the content of reports and the 30-day post-incident summary.
• Sector rules. Financial, telecoms, industrial, health and automotive regulators impose their own reporting lines. The CAC Measures state that industry reporting rules continue to apply alongside the national regime.

Sector rules deserve their own line in any plan. Banks, insurers, payment institutions and securities firms answer to financial regulators with their own incident and outsourcing requirements; telecoms and internet businesses answer to MIIT and its provincial communications administrations; hospitals answer to health authorities; and carmakers handling vehicle data have automotive data rules. Where a sector rule sets a shorter or different reporting channel, it runs in parallel with the CAC report rather than replacing it. A single table in the response plan that lists every regulator, its channel, its deadline and the internal owner of each report saves valuable minutes on the day.

Overlaying all of this is the Multi-Level Protection Scheme for information systems, under which public security organs supervise system security. Suspected crimes, such as ransomware attacks, intrusions or insider theft, must also be reported to the police.

Grading and reporting an incident

The Incident Reporting Measures attach a grading guide with four levels: general, relatively major, major and particularly major. Reporting is mandatory for relatively major incidents and above. The guide uses typical indicators, and an incident meeting any one indicator is graded at that level. Companies should note that the thresholds count people affected, not records, and that duplicates across systems should be resolved quickly to avoid over or under-grading.

The guide also contains indicators relating to disruption of public services by population affected, and to the spread of unlawful content. A breach affecting fewer than one million people may still trigger PIPL notification duties, sector reporting and contractual notice to customers, so a "general" grading is never the end of the analysis.

Reporting deadlines, recipients and report content

The Measures set different clocks according to who the operator is. They run from discovery, and a preliminary report may be filed before the cause is known.

A report should cover the affected entity and systems; the time, place, type, level and impact of the incident and measures taken; for ransomware, the ransom demanded, payment method and date; likely developments; preliminary cause; traceability leads such as attack path and exploited vulnerabilities; planned response; and whether the scene has been preserved. If the cause or impact is unclear, the operator may report the basic facts first and supplement later. Significant new developments must be reported promptly.

Security and operations service providers that discover an incident must tell the operator, which then reports. In practice this means outsourcing contracts with managed security providers, cloud vendors and IT integrators should contain matching notification duties measured in minutes, not days.

Notifying individuals, customers and counterparties

Under PIPL Article 57, notice to individuals should describe the categories of personal information involved, the cause and possible harm, the remedial measures taken, steps individuals can take to reduce harm, and contact details for the processor. Where the processor's measures can effectively prevent harm, it may decide not to notify individuals, but the regulator can require notification if it considers harm possible. That exception should be documented carefully, because it will be tested if harm later emerges.

Sensitive personal information changes the calculus. Leaks of biometric data, medical records, financial accounts, precise location or information about minors under 14 carry higher risk of harm and attract closer scrutiny. Facial information is a particular focus: the Security Management Measures for the Application of Facial Recognition Technology, effective 1 June 2025, require a filing with the provincial cyberspace authority once a processor stores facial information of 100,000 people, and a leak of such data will be viewed seriously.

Contractual notice is the third layer. Entrusted processors acting for a client must inform the client under their processing agreement. Joint processors need to agree who communicates with individuals. Commercial contracts frequently impose notice periods of 24 to 72 hours on suppliers, and missing them can lead to claims that outlast the regulatory issue.

A first 72-hour data breach response playbook

The following sequence reflects how a well-run data breach response typically unfolds for a multinational group with a mainland subsidiary. It assumes a ransomware intrusion detected on a Monday morning in a Shenzhen entity that holds customer and employee data.

1. Hour 0 to 1: contain and convene. Isolate affected systems, preserve logs and images, and convene the incident team, including legal, IT security, communications and the China business lead. Confirm whether the entity or any system has been designated as CII.
2. Hour 1 to 3: grade. Estimate the number of individuals affected, the categories of data and the likely economic loss against the grading guide. Record the basis for the grading and who approved it.
3. Hour 3 to 4: preliminary report. If relatively major or above, file the preliminary report with the provincial cyberspace authority. Report the suspected crime to public security. Check sector regulator rules in parallel.
4. Day 1: brief headquarters lawfully. Share forensic findings with overseas teams in a way that respects cross-border transfer rules and restrictions on providing data to foreign authorities.
5. Day 1 to 2: individual and customer notice. Decide whether PIPL notice is required, draft notices in Chinese and English, and prepare call centre scripts.
6. Day 2 to 3: foreign clocks. Assess GDPR, Hong Kong, US securities or other foreign obligations triggered by the same facts and align messaging.
7. Within 30 days of closure: summary report. File the post-incident summary covering cause, harm, accountability and remediation, and update policies.

Cross-border data breach response: aligning China, Hong Kong, the EU and the US

Groups listed or operating abroad face several regimes at once. A coordinated cross-border data breach response uses one fact base, one grading logic and one set of approved messages, and adapts them to each regulator's form and timing. The table below compares the main clocks.

Three tensions recur. First, foreign regulators or courts may ask for underlying data; the Data Security Law and PIPL prohibit providing data stored in China to foreign judicial or law enforcement bodies without PRC approval, so requests should be routed carefully. Second, disclosure to investors may become public before Chinese authorities have been briefed, which is avoidable with sequencing. Third, descriptions of the cause must be consistent across filings, because inconsistent statements are easily compared. Our guide to EU data and cyber rules for Chinese companies explains the European side in more detail.

Common mistakes and how to build readiness

The most frequent failures we see in incident reviews are organisational rather than technical:

• No one in China is authorised to decide the grading or file a report, so the four-hour window passes while headquarters deliberates.
• The emergency plan pre-dates November 2025 and still assumes a 24-hour or "prompt" standard.
• Managed security providers have no contractual duty to notify within minutes.
• Numbers of affected individuals are taken from record counts without de-duplication, producing an inflated grading.
• Forensic data is exported overseas without a transfer mechanism.
• Individual notices are drafted in English first and translated late, delaying release.
• Ransom payments are considered without assessing sanctions, anti-money laundering and reporting consequences.

Readiness is cheaper than remediation. A useful programme includes an incident response plan mapped to the CAC grading guide, a contact sheet for the provincial cyberspace authority, public security and sector regulators, pre-approved templates in Chinese, a decision matrix delegating authority to the China entity, and tabletop exercises run at least annually. Companies processing personal information of more than ten million people must also complete a PIPL compliance audit at least every two years under the CAC audit measures effective 1 May 2025, and regulators may order an audit after an incident.

Governance matters too. Boards and audit committees of groups with significant China operations increasingly ask for a periodic report on incident readiness, including the results of exercises and the status of vendor contracts. Cyber insurance policies should be read against the Chinese timetable: some policies require insurer consent before engaging forensic firms or counsel, which can conflict with a four-hour reporting window unless panel providers in China are pre-approved. Finally, keep a short log of each decision taken during an incident, by whom and on what information. That log is the best evidence of good faith if a regulator later questions the grading or the timing of a report.

Incidents rarely stay within one discipline. They often reveal weaknesses in personal information protection (PIPL) compliance, gaps in cross-border data transfer mechanisms or uncertainty about important data and data security classification. When an incident becomes a regulatory investigation or prompts an internal inquiry into insider conduct, the work moves into internal and government investigations. For a cross-practice overview, see our China data compliance hub.

How TRW & Co helps with data breach response

We help multinational groups and Chinese companies prepare for and manage incidents that cross borders. We design incident response plans and playbooks aligned to the CAC grading guide and to international regimes, review vendor contracts, and run tabletop exercises for China and regional teams. During a live incident we coordinate the global data breach response, advise on the laws of jurisdictions where our lawyers are qualified, manage parallel workstreams and help align messaging to regulators, customers and investors. Where PRC legal advice, regulatory reports or communication with Chinese authorities are required, we work alongside licensed PRC law firms. To discuss readiness or an active incident, please contact us.