Breach notification requirements are contained in the CSL, DSL and PIPL, and should be read together. "Network security incidents" that are notifiable are defined by reference to seven categories of different incident types, in particular:

1. Malicious program incidents; 
2. Network attack incidents;
3. Data security incidents;
4. Information content security incidents; 
5. Equipment and facility failure incidents;
6. Operational violation incidents;
7. Security risk incidents;
8. Abnormal behavior incidents;
9. Force majeure incidents; and
10. Other cyber incidents. 

Guidelines set out other factors that should be considered whether a network security incident is potentially reportable. The China National Internet Emergency Center may be contacted in case of doubt as to whether an incident is potentially reportable.

An incident must be immediately notified: (i) internally, to the DPO; and (ii) externally, to the regulator (the PIPL refers to the CAC establishing (local) "personal information protection departments" (PIPD) for such purposes, but this is yet to be confirmed), and should include:

• affected data categories;
• reasons for the incident, and potential consequences;
• remedial measures, and mechanisms required by data controller to minimize impact; and
• contact information for data controller.

If the data controller can effectively avoid the disclosure, loss or tampering of data, the PIPL suggests that there is no need to notify data subjects. Otherwise (and as per the CSL and DSL) data subjects must be notified immediately if the actual or suspected network security incident may result in harm to the rights and interest of the affected data subjects. Further, if the PIPD believes it may cause impact to individuals, they may request that the data controller notifies individuals. Similar information must be given to the data subjects alongside advice on how to protect against risks arising from the incident.

Notably, the Network Data Security Management Regulation (intended to supplement the PIPL) clarifies that an incident that could harm national security or public interests must be reported to the authorities within 24 hours of identification.

Organizations should also adopt proactive measures to minimize the risk of personal information breaches or security incidents, including but not limited to, implementing and testing a data incident contingency plan and organizing training.

Further changes are also expected in this regard. We understand the regulators are working on a project to publish further guidelines as to how network security incidents should be managed. On 8 December 2023, the CAC released the Draft Administrative Measures on Cybersecurity Incident Reporting to solicit public opinions.

For security incidents in the field of industry and information technology, the Ministry of Industry and Information Technology published the Emergency Plan for Data Security Incidents in the Field of Industry and Information Technology (for Trial Implementation) on October 29, 2024, which is effective from November 1, 2024. This Emergency Plan provides new mechanisms to classify cybersecurity incidents and new reporting obligations for data handlers in the field of industry and information technology.