Incident · 05 Editorial guide
Incidents & notification
Incidents are parallel clocks. Contain, preserve and classify first, then test cybersecurity-event reporting, personal-information notice, sector, contractual and overseas obligations separately.
First job Contain and record before treating the event as a general PIPL essay.
Start here
Key considerations
The first questions are about urgency, governance and preservation — before collection expands or interviews begin.
- What may have leaked, and when?
- Is containment underway?
- Which one-, two- or four-hour regulatory route, PIPL notice, sector or contractual duty may apply?
Decision map
Keep the question bounded.
- ContainActivate one incident owner, stop continuing exposure safely, protect business continuity and preserve volatile evidence.
- RecordRecord discovery, occurrence, affected systems, data, people, impact, measures and unresolved facts.
- Classify and reportUse the national severity guide and route CII, central-body or other operator reports without waiting for perfect root-cause analysis.
Timeline
Sequence and clocks that change the next action.
- First hourCII operators must report qualifying events to the protection department and public-security organ as soon as possible and no later than one hour.
- Two or four hoursCentral/state bodies use the two-hour route; other operators report qualifying events to the provincial cyberspace authority within four hours.
- During responseSupplement material facts and progress, evaluate individual notice and sector, police, customer, insurer and overseas duties.
- Within 30 days after closurePrepare the required cause, response, harm, responsibility, remediation and lessons-learned report through the original channel.
Curated resources
Open the asset that matches this job.
Data breaches in China
Orientation for leakage, notice and next-step questions — not an incident playbook verdict.
China data compliance decision guide
National PIPL, transfer and cybersecurity decision desk — not a substitute for a filing pack.
National Cybersecurity Incident Reporting Measures
Effective 1 November 2025: classification, one-, two- and four-hour reporting routes, report content, updates and 30-day closeout.
Helpful to prepare
Facts that make the next conversation clearer.
These items are orientation aids, not a legal requirement list.
Evidence file
Preserve the record before the forum is chosen.
This is a preparation prompt, not a finding that any item is admissible or required.
- High-level incident chronology
- Systems and data categories involved
- Whether overseas recipients may be affected
- Notices already sent, if any
- Severity decision, reporting channel and timestamp evidence
- Containment, forensic preservation and remediation log
Local context
Add the city when regulator practice changes.
CAC and industry-regulator practice can differ after the national transfer or cybersecurity question is identified.
Open city and province guidesCounsel hand-off
Need data-privacy counsel?
This hub organises PIPL, cybersecurity and export questions. It does not decide whether a transfer is lawful or whether notice is required on your facts.
Find data-privacy counselLegal review
Who reviewed this guide
Need qualified counsel?
Move carefully. Move with a record.
Use the portal to identify counsel for this practice and related China-side issues.