China. Breach notification. Departmental rules
Cyber Incident Reporting MeasuresAdministrative Measures for Reporting National Cybersecurity Incidents (国家网络安全事件报告管理办法)
In force
Partly verified
Medium confidence.Official title and adoption date from memory of CAC naming; only effective date and tiering verified via DLA Piper. [Link: official Chinese (CAC, published 2025-09-15); CLT translation]
§1Summary
- Synopsis
Sets a four-level classification of cybersecurity incidents and hour-based deadlines for reporting them to regulators. Applies to network operators, including incidents involving personal information leaks.
- Key themes
- Unique features
The shortest reporting deadline is four hours from awareness for the most serious incidents.
- SaaS relevance
SaaS network operators in China need incident runbooks able to meet hour-level reporting deadlines.
§2Obligations
- Breach notification
- Tiered; as short as 4 hours for particularly significant incidents
§3Dates
- Key dates
- In force
§4Text and authority
- Text
- Authoritative text cac.gov.cn
- English text chinalawtranslate.com
- Authority
- Cyberspace Administration of China (CAC)
§5Where it applies
- Domestic law of
- China
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Official title and adoption date from memory of CAC naming; only effective date and tiering verified via DLA Piper. [Link: official Chinese (CAC, published 2025-09-15); CLT translation]