If user data in your website or app is breached, immediately remediate, notify affected users and regulatory authorities, and report cyberattacks to public security

If a breach, tampering, or loss of personal information occurs or is suspected, you must immediately deploy remedial containment, notify regulatory authorities, and alert affected users. Concealing breaches leads to regulatory orders for rectification; non-compliance carries fines up to 1 million RMB, or up to 50 million RMB for egregious violations. If users suffer damages and you fail to prove absence of fault, you bear tort liability. Taking reasonable security measures, executing incident response protocols, and reporting promptly can mitigate or waive penalties.

Free. Requires having a predefined data incident emergency response plan in advance: designating decision-makers, establishing containment protocols, and preparing communication templates for affected users. The psychological friction is the natural instinct to cover up the incident to avoid reputational damage.

Article 57 of the Personal Information Protection Law (PIPL) provides that upon the occurrence or potential occurrence of personal data leaks, alterations, or loss, processors must immediately take remedial actions and notify supervisory authorities and affected individuals. Breach notifications must detail: (1) categories of data compromised, root cause, and potential harm; (2) remedial countermeasures taken and self-protection steps available to users; and (3) processor contact credentials. Notification to users may be waived only if remedial measures effectively prevent harm, though regulatory authorities retain the power to compel notification if harm remains possible. The Network Data Security Management Regulations permit notifications via telephone, SMS, instant messaging, email, or public announcements. Discovered criminal leads must be reported immediately to public security or state security agencies. Failure to fulfill data protection obligations triggers orders for correction, warnings, confiscation of unlawful gains, and suspension/termination of offending apps. Refusal to correct incurs fines up to 1 million RMB (with responsible supervisors fined 10,000–100,000 RMB). Severe violations incur fines up to 50 million RMB or 5% of annual turnover, with executives fined 100,000–1,000,000 RMB. Under civil tort law (Article 69), processors bear presumed liability unless they prove absence of fault. Under Cyberspace Administration of China (CAC) incident reporting rules, breaches affecting over 1,000,000 individuals constitute "major network security incidents" requiring formal reporting to provincial cyberspace authorities within at most 4 hours (e.g. via the 12387 hotline), followed by a comprehensive summary report within 30 days. Conversely, entities maintaining verified baseline defenses, following incident contingency plans, and reporting proactively may receive mitigated penalties or exemption from administrative liability.

Even for small web services where breaches affect hundreds or thousands of users, the PIPL remedial and user notification requirements apply, although the 4-hour CAC threshold is not triggered. When notifying users, provide specific guidance: suggest which account credentials to reset and warn against incoming social engineering or phishing scams mimicking support personnel. Retaining security audit logs for at least 6 months is essential to trace intrusion vectors during post-incident investigations (see Chapter 11, Rule 16). For end-user defense against data breaches, see Chapter 14.

全国人大常委会 (2021). 个人信息保护法（第五十七、六十六、六十九条）. https://www.spp.gov.cn/spp/fl/202108/t20210820_527244.shtml ; 全国人大常委会 (2025). 网络安全法（2025 年修正，2026 年 1 月 1 日施行，第二十七、四十四、七十一条；2016 年文本为第二十五、四十二条）. https://www.cac.gov.cn/2025-12/29/c_1768735112911946.htm ; 国务院 (2024). 网络数据安全管理条例（国务院令第 790 号，第十一条）. https://www.gov.cn/gongbao/2024/issue_11646/202410/content_6980863.html ; 国家互联网信息办公室 (2025). 国家网络安全事件报告管理办法（第四、八、九、十、十一条，附件《网络安全事件分级指南》）. https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm