Incident Response Lawyers in China

An incident file should not wait for perfect forensic certainty. The response team needs to contain the event, preserve reliable evidence, determine affected systems and data, protect people and operations, assess reporting and notification duties, and control communications while facts continue to change.

Questions that change the route

What is happening now?

Record discovery time, affected services, attack or failure path, persistence, access, exfiltration indicators, business impact, and containment decisions.

Whose data or systems are affected?

Classify network, personal, sensitive personal, important, regulated, customer, employee, and third-party data together with the responsible entities and sectors.

Who must be told and when?

Build a live matrix for CAC and sector reporting, public-security referral, critical-infrastructure channels, individuals, customers, counterparties, insurers, and overseas authorities.

Evidence to organize first

• Incident chronology, decision log, system images, logs, alerts, accounts, and chain of custody
• Affected-system, entity, data, person, geography, and service-impact map
• Draft regulator, individual, customer, insurer, and board communications with approval record

Official orientation sources: Personal Information Protection Law overview · Network Data Security Management Regulation · National Cybersecurity Incident Reporting Measures. Source check: 5 October 2026.