4 questions before you choose the route.
This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.
What data and systems?
PI, SPI, important data, CII network.
ScopeWhich statute fired?
PIPL and/or CSL/DSL/sector.
StatuteWho must be told?
CAC/MPS/sector and individuals if harm likely.
WhoCan you honestly say harm is avoided?
If not, individual notice is in play.
HarmWorking rule: PIPL requires handlers to take remedial action and notify authorities and individuals when PI is leaked, tampered with or lost, with some relief if measures effectively avoid harm (authority notice may still apply).
The signal ledger.
These facts move the question beyond a label and into a product, money-flow and control analysis.
Bring a compact evidence docket—not a pitch deck.
Give a compliance team or counsel the operating facts that reveal the perimeter.
Questions people ask before they build.
Short answers for orientation. The right result can change with the service model and current rules.
Is there a 72-hour rule?
Not as a universal PIPL copy of GDPR. Sector and CSL incident measures have their own clocks — read the current ones.
Do we notify individuals if we encrypted the disk?
If harm is truly avoided, PIPL allows a narrower individual notice — but that is a high bar and authorities may still need notice.
Primary authorities
Reviewed sources support orientation, not a fact-specific assessment.