Breach notification requirements are contained in the CSL, DSL and PIPL, and should be read together. "Network security incidents" that are notifiable are defined by reference to seven categories of different incident types, in particular:

1.  Malicious program incidents;
2. Network attack incidents;
3. Data security incidents;
4. Information content security incidents;
5. Equipment and facility failure incidents;
6. Operational violation incidents;
7. Security risk incidents;
8. Abnormal behavior incidents;
9. Force majeure incidents; and
10. Other cyber incidents. 

Guidelines set out other factors that should be considered whether a network security incident is potentially reportable.

The requirements for reporting incidents are complex. For example, under the PIPL, the data controller has the obligation to report an incident to the local CAC and the affected data subjects. The only exemption is that, if the controller believes that sufficient measures have been implemented to effectively avoid any harm to data subjects and public interests, it may decide not to notify the data subjects. However, the CAC may veto this decision and request that the controller notify the data subjects. In practice, there are complicated factors that data controllers should consider before submitting any formal reports to the CAC or the data subjects.

The Administrative Measures for Network Security Incident Reporting (“Measures“), which provide further guidance on when and how to report network security incidents under existing laws such as the CSL, the DSL and the PIPL. The Measures took effect on 1 November 2025.

The Measures for the Administration of the Reporting of Cybersecurity Incidents (effective from 1 November, 2025) further classify incidents as particularly significant incidents, significant incidents, major incidents or general incidents. Different reporting requirements are set out for different categories of incidents, with the shortest reporting deadline set as within four hours of becoming aware of it.