China Data Breach Notification Requirements 2026: Who Must Report, the CAC 4‑hour Rule and Practical Compliance Steps

Understanding China data breach notification requirements is now an operational priority for every company that processes data within the People’s Republic of China. Since 1 January 2026, the Cyberspace Administration of China (CAC) has enforced tighter cybersecurity incident reporting obligations, including a mandatory four‑hour reporting window for qualifying incidents, new severity classifications, and designated reporting channels such as the 12387 incident reporting hotline. This guide sets out the full legal framework, walks through the decision flow for who must report and to whom, and provides the practical checklists and templates compliance teams need to respond within the compressed timelines that now apply.

Quick answer: the bottom line for companies

Before diving into the detail, here is the headline roadmap every DPO, general counsel and security‑operations lead should internalise.

• Four‑hour clock. Operators that discover a cybersecurity incident meeting the CAC’s severity thresholds must submit an initial report to their local (provincial‑level) CAC office within four hours of becoming aware of the incident.
• Severity drives routing. Incidents classified as “severe” or “extremely severe” trigger an additional one‑hour escalation from the provincial CAC to the national CAC.
• Multiple notification streams. Regulator reporting (to the CAC) and individual notification (to affected data subjects under the Personal Information Protection Law, or PIPL) run in parallel, missing either stream carries separate liability.
• Reporting channels. The CAC accepts reports via the 12387 cybersecurity incident reporting hotline, a dedicated WeChat mini‑program, and provincial CAC online portals.
• Evidence preservation starts immediately. Logs, network traffic captures, forensic images and chain‑of‑custody records must be preserved from the moment an incident is suspected, not after reporting is complete.
• Cross‑border implications. If the affected data was subject to a CAC security assessment or cross‑border data transfer certification, the incident may trigger a re‑assessment or suspension of the approved transfer mechanism.
• Language matters. Submissions to the CAC must be in Chinese. Foreign‑invested enterprises should engage local counsel or an internal Chinese‑speaking compliance function in advance.

Scope: which laws and rules apply to China data breach notification requirements in 2026?

China does not have a single, self‑contained breach‑notification statute. Instead, data breach reporting obligations arise from three principal laws and a newer set of implementing measures that took effect at the start of 2026. Each instrument addresses a different slice of the data‑protection landscape, and most organisations will find that at least two, and often all four, apply simultaneously.

Personal Information Protection Law (PIPL China)

Effective since 1 November 2021, PIPL China is the closest analogue to the EU’s GDPR. Article 57 requires personal information processors to notify the authority exercising personal information protection duties and, where the incident may cause harm, to notify affected individuals. PIPL does not set a fixed hour‑count for regulator notification; instead, it uses the language “immediately” (立即), leaving the operational timeline to be clarified by subordinate measures, which is precisely what the CAC’s 2026 rules now do.

Data Security Law (DSL)

The Data Security Law, effective since 1 September 2021, addresses the broader category of “data”, not only personal information, and imposes security‑incident reporting obligations on data processors. Article 29 requires organisations to take remedial measures immediately upon discovering a data security incident, notify users, and report to the competent authority. The DSL is especially relevant for incidents involving “important data” or “core data” as designated under China’s tiered data‑classification scheme.

Cybersecurity Law and Critical Information Infrastructure (CIIO) rules

The Cybersecurity Law (effective 1 June 2017) applies to “network operators,” a broad category that captures virtually any entity operating a computer network in China. Critical Information Infrastructure Operators (CIIOs), companies in sectors such as telecommunications, energy, transport, finance and public services whose systems, if compromised, could endanger national security, bear heightened obligations, including mandatory CAC security assessments for outbound data transfers.

CAC Measures on cybersecurity incident reporting (effective 1 January 2026)

The State Measures on the Management of Cybersecurity Incident Reporting, finalised in late 2025 and effective from 1 January 2026, are the most operationally significant development. They codify the four‑hour reporting window, define four tiers of incident severity, designate the 12387 hotline and WeChat mini‑program as official reporting channels, and establish the provincial‑to‑national escalation framework. Industry observers note that these measures transformed what was previously a patchwork of guidance documents into a binding and enforceable procedural regime.

Which incidents must be reported and to whom?, the decision flow

Not every security event rises to the level of a reportable cybersecurity incident. The CAC’s 2026 Measures establish four severity tiers, each carrying different reporting and escalation obligations. Mapping your incident to the correct tier is the first critical step.

Incident severity classifications

The State Measures on the Management of Cybersecurity Incident Reporting define the following tiers:

• Minor incident (一般事件). Limited impact on systems or data, affecting a small number of users or a non‑critical system. Reporting to the provincial CAC is required within the standard four‑hour window.
• Serious incident (较大事件). Broader impact, for example, personal information of 100,000 or more individuals leaked, or significant disruption to a network service. Four‑hour provincial CAC reporting applies.
• Severe incident (重大事件). Large‑scale data compromise, disruption to critical infrastructure, or leakage of important data as classified under the DSL. The provincial CAC must escalate to the national CAC within one hour of receiving the report.
• Extremely severe incident (特别重大事件). National‑security‑level impact, massive data exfiltration or prolonged disruption of critical services. Immediate provincial reporting plus one‑hour national escalation applies, and the CAC may assume direct oversight of the response.

Who reports: entity types and their obligations

The data breach reporting obligations differ depending on the nature of the reporting entity. In practice, most companies fall into at least one, and sometimes more than one, of these categories.

Regulator routing: provincial CAC, national CAC and sectoral bodies

The default first point of contact is the provincial‑level CAC office where the entity’s principal operations or registered office is located. For CIIOs, sector‑specific regulators (for example, the People’s Bank of China for financial institutions, or MIIT for telecommunications companies) may also require concurrent notification. The provincial CAC serves as the gateway: it receives the initial report within four hours, assesses severity, and, for severe or extremely severe incidents, escalates to the national CAC within one hour. Companies should pre‑map their provincial CAC contact details and any applicable sectoral regulator well before an incident occurs.

The CAC 4‑hour rule explained, practical interpretation for cybersecurity incident reporting

The four‑hour reporting requirement is the single most operationally demanding element of the 2026 framework. Getting it right requires clarity on three questions: when does the clock start, which incidents are in scope, and how does the escalation ladder work?

What “within four hours” means: discovery versus awareness

The CAC Measures use the concept of “discovery” (发现) as the trigger. The clock starts when the organisation, through its monitoring systems, staff reports, third‑party alerts, or any other means, becomes aware or reasonably should have become aware that a cybersecurity incident has occurred. This is not the moment the incident began (which may have been days or weeks earlier), but the moment the organisation gained actual or constructive knowledge. In practice, the likely effect is that automated monitoring tools and SOC (Security Operations Centre) alert timestamps will be treated as the evidence of awareness, making investment in real‑time detection critical.

Which incidents trigger four‑hour reporting?

All four severity tiers, from minor to extremely severe, require an initial report to the provincial CAC within four hours. However, the completeness of the initial report may differ. For minor incidents, a brief factual notification with the core fields (what happened, when it was detected, preliminary impact assessment, containment actions taken) is expected. For serious, severe and extremely severe incidents, the CAC expects a more detailed initial submission and may issue follow‑up requests within hours.

Provincial versus national escalation, the one‑hour rule

After receiving a report that it classifies as severe or extremely severe, the provincial CAC must escalate to the national CAC within one hour. This one‑hour escalation is the provincial authority’s obligation, not the reporting entity’s. However, companies should be prepared for the national CAC to contact them directly once escalation has occurred, and response teams should have senior management availability confirmed around the clock.

Sample internal SLA matrix

The following timeline illustrates how the four‑hour rule might play out in practice for a serious incident detected by an automated intrusion‑detection system at 02:00.

• T + 0 min (02:00). SOC alert triggered. On‑call analyst begins triage.
• T + 30 min (02:30). Incident confirmed as real (not a false positive). DPO and legal on‑call notified. Clock starts.
• T + 90 min (04:00). Containment actions initiated. Forensic imaging of affected systems begins.
• T + 180 min (05:30). Draft CAC submission reviewed by legal. Core fields populated.
• T + 240 min (06:30). Initial report submitted to provincial CAC via 12387 hotline or online portal, within the four‑hour window from awareness at 02:30.

How to report: the 12387 incident reporting hotline, WeChat mini‑program and provincial portals

The CAC has designated multiple reporting channels to accommodate different operational scenarios. Companies should identify and test their preferred channel before an incident occurs, discovering that a portal URL has changed or that a WeChat mini‑program requires corporate verification at 03:00 during a live incident is a failure mode that can be eliminated through advance preparation.

12387 hotline: how to call and what to have ready

The 12387 incident reporting hotline is a dedicated voice line operated by the CAC. Callers will navigate an automated menu (in Mandarin Chinese) before being connected to an operator. To use the hotline effectively during a live incident, prepare the following information in advance:

• Company name, unified social credit code, and registered address
• Name and contact details of the incident coordinator (typically the DPO or CISO)
• Date and time the incident was discovered
• Preliminary classification of severity
• Brief description of the incident type (e.g., data exfiltration, ransomware, unauthorised access)
• Estimated number of affected records or individuals
• Containment actions taken or underway

WeChat mini‑program: search terms and practical tips

The CAC has deployed a WeChat mini‑program that allows incident reports to be submitted directly through the WeChat platform. Users can locate it by searching for the official CAC cybersecurity reporting mini‑program within WeChat’s search function. The mini‑program presents a structured form with required fields that mirror the hotline submission requirements. Early indications suggest that the mini‑program is the fastest channel for after‑hours submissions, as it avoids telephone queue times and produces an automatic receipt with a timestamp, valuable evidence for compliance records.

Provincial CAC online portals

Most provincial‑level CAC offices maintain online portals for incident submissions. Portal URLs and interfaces vary by province, and not all portals are available 24/7. Companies should bookmark and periodically test their relevant provincial CAC portal, confirm login credentials (some portals require pre‑registration), and save offline copies of the submission form template.

Quick submission checklist: recommended fields for any channel

• Reporting entity name and unified social credit code
• Contact person, role, phone number and email
• Date and time of incident discovery (timestamp)
• Preliminary severity classification (minor / serious / severe / extremely severe)
• Incident category (data breach, ransomware, DDoS, insider threat, other)
• Systems affected (names, IP ranges, data types)
• Estimated scope: number of records, individuals, or services affected
• Personal information involved? (Yes / No, if yes, categories of PI)
• Important data or core data involved? (Yes / No)
• Containment and remediation actions taken so far
• Whether law enforcement has been notified
• Preliminary root‑cause analysis (if available)

Notification to affected individuals versus regulator, timing and messaging

A PIPL incident response requires two parallel notification streams: one to the regulator (covered above) and one to affected individuals. These obligations are legally independent, and completing one does not excuse delay in the other.

PIPL thresholds for individual notification

Under Article 57 of PIPL, personal information processors must notify affected individuals when a leakage, tampering, or loss of personal information “occurs or may occur” and the incident may cause harm to the rights and interests of individuals. The threshold is low: if there is a reasonable possibility of harm, including identity theft, financial loss, reputational damage or discrimination, notification is required. PIPL permits organisations to forgo individual notification only where effective measures have been taken to avoid the harm, and the processor can document that conclusion.

Sample individual notification message

Individual notifications should, at a minimum, include the following elements (modelled on Article 57 of PIPL):

• The types of personal information involved
• The cause of the incident (to the extent known)
• Potential harm that may result
• Remedial measures the organisation has taken or will take
• Steps the individual can take to mitigate risk (e.g., changing passwords, monitoring accounts)
• Contact details for the organisation’s responsible person or DPO

When delay is permissible, legal risk matrix

PIPL does not expressly authorise a general delay in individual notification. However, if the regulator instructs the organisation to postpone public disclosure to protect an ongoing investigation or to prevent further harm, compliance with that instruction will ordinarily shield the processor from liability for delayed individual notification. Companies should document any such instruction in writing and retain it as part of the incident record.

Evidence preservation, incident logs and internal escalation

Effective PIPL incident response depends on evidence that is collected and preserved from the first moments of detection. Regulators and, in enforcement proceedings, courts will scrutinise the quality of an organisation’s contemporaneous records.

Forensics and chain‑of‑custody checklist

• Create forensic bit‑for‑bit images of affected systems before any remediation
• Preserve firewall, IDS/IPS, SIEM and application logs covering at least 30 days before the incident
• Record hash values (SHA‑256) of all preserved evidence and log each access event
• Store evidence on write‑protected or immutable media
• Engage a qualified digital forensics provider if in‑house capability is insufficient

Internal escalation matrix, who signs off within four hours

Companies should define a standing escalation matrix that identifies, by role, who must be informed and who has authority to approve the CAC submission. A typical matrix includes the SOC analyst (detection), the CISO or IT security manager (confirmation and containment), the DPO or chief compliance officer (legal assessment and submission drafting), and the CEO or general manager (sign‑off for severe or extremely severe incidents). Pre‑delegated authority is essential: if the CEO is unreachable at 03:00, the compliance function must have standing authorisation to submit.

Recordkeeping for enforcement defence

Maintain a single, centralised incident log for each event. The log should record every action taken, the timestamp, the responsible person, and the outcome. This log serves three purposes: it evidences compliance with the four‑hour rule; it supports any subsequent CAC investigation or audit; and it forms the basis for internal lessons‑learned reviews. Store incident logs for a minimum of three years, longer if the incident involves important data or triggers litigation.

Cross‑border data transfer and certification implications after an incident

For multinational companies, a cybersecurity incident in China may have consequences that extend beyond domestic compliance. Where the compromised data was the subject of an approved cross‑border data transfer mechanism, whether a CAC security assessment, a cross‑border data transfer certification, or standard contractual clauses (SCCs), the incident creates additional obligations.

Does a breach affect cross‑border data transfer certification or a CAC security assessment?

The short answer is: it can. A serious or severe data breach may be treated by the CAC as a material change in the circumstances upon which the original security assessment or certification was granted. In practice, companies should expect the CAC to inquire whether the incident was caused by or facilitated by the cross‑border transfer, and whether the data‑importing party’s security measures were adequate. If the CAC determines that the transfer mechanism is no longer compliant, it may require a supplemental assessment or, in extreme cases, suspend the transfer.

Practical steps when exported data is compromised

• Notify the overseas data recipient immediately and coordinate containment across jurisdictions
• Review the original security assessment or SCC to identify any breach‑notification obligations owed to the CAC under the transfer mechanism
• Prepare a supplemental impact assessment documenting whether the cross‑border transfer contributed to the incident
• Engage local counsel in both China and the recipient jurisdiction to manage parallel regulatory obligations
• If the CAC requests a re‑assessment, cooperate promptly, delay may be treated as a separate compliance failure

Practical compliance checklist and templates for China data breach notification requirements

The following phased checklist distils the obligations discussed above into an actionable workflow. Compliance teams should adapt it to their organisation’s size, sector and risk profile.

First 4 hours (from discovery)

• Confirm the incident is real (not a false positive)
• Activate the internal escalation matrix, notify CISO, DPO and legal
• Begin evidence preservation (forensic imaging, log retention)
• Initiate containment actions to limit further data loss
• Classify incident severity (minor / serious / severe / extremely severe)
• Draft the initial CAC submission using the quick submission checklist
• Submit the report to the provincial CAC via the 12387 hotline, WeChat mini‑program, or online portal
• Record the submission timestamp and any reference number received

24–72 hours

• Conduct a more detailed impact assessment (scope, root cause, affected data categories)
• Prepare and issue individual notifications to affected data subjects under PIPL (where the harm threshold is met)
• Submit a supplementary report to the CAC with updated findings
• Notify any applicable sectoral regulators (e.g., PBOC, MIIT)
• If cross‑border data was affected, notify the overseas data recipient and review transfer mechanism obligations

First 30 days

• Complete the forensic investigation and produce a root‑cause analysis
• Submit the final incident report to the CAC (the Measures contemplate a follow‑up report after the investigation is substantially complete)
• Implement remediation measures and document them
• Conduct an internal lessons‑learned review and update the incident response plan
• If a CAC security assessment or cross‑border data transfer certification is in force, evaluate whether a supplemental assessment filing is required

Ongoing regulatory follow‑up

• Respond to any CAC or sectoral regulator inquiries within the timelines they specify
• Retain all incident records for a minimum of three years
• Update the organisation’s data‑protection impact assessments and security policies to reflect lessons learned
• Schedule a tabletop exercise within 90 days to test the revised incident response plan

Conclusion: building a China data breach notification requirements compliance programme

The 2026 regulatory landscape for China data breach notification requirements leaves little margin for improvisation. The four‑hour CAC reporting window, the four‑tier severity classification, the parallel PIPL individual‑notification obligation, and the potential impact on cross‑border data transfer certification all demand that companies build, test, and maintain an incident‑response capability that is operational around the clock. Compliance is not a document, it is a rehearsed, staffed, and continuously updated operational function. Organisations that invest in pre‑mapped escalation matrices, pre‑drafted submission templates, and regular tabletop exercises will be positioned not only to meet the legal requirements but to contain incidents faster and limit regulatory exposure.

Those that treat the framework as an afterthought will likely discover the cost of non‑compliance in the form of enforcement actions, reputational damage, and disrupted cross‑border data flows.

Last reviewed: 20 May 2026. This article will be updated following any new CAC guidance, implementing rules, or significant enforcement decisions.

Sources

1. China Law Translate, State Measures on the Management of Cybersecurity Incident Reporting
2. Bird & Bird, New Cybersecurity Incident Reporting Measures in China
3. DLA Piper Privacy Matters, China: New Stricter and 4‑Hour Data Breach Reporting Requirements
4. Herbert Smith Freehills / HSF Kramer, China Releases Final Measures on Cybersecurity Incident Reporting