Personal Information Protection Law, Data Breach Notification

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 November 2021.

A breach notification rule binding public and private bodies.

As of 23 August 2026.

What it requires

Upon discovering an actual or possible leak, alteration, or loss of personal information, immediately take remedial measures and notify both the competent personal information protection department and every affected individual, unless the remedial measures can be shown to effectively prevent harm.
Include in any breach notice the categories of information involved, the cause, possible harm, remedial steps taken, what affected individuals can do to protect themselves, and the handler's contact information.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Upon discovering an actual or possible leak, tampering, or loss of personal information, a handler must immediately take remedial measures and notify both the department responsible for personal information protection and the affected individuals, with the notice covering the categories of information involved, the cause, possible harm, remedial measures, mitigation steps for individuals, and the handler's contact information.

Individual notice may be omitted where remedial measures can be shown to effectively prevent harm, unless the supervisory department requires notice anyway. The statute requires action taken immediately rather than setting a fixed numeric deadline such as 72 hours.

When LexLint raises it

crawls_web
trains_models
processes_voice
processes_biometrics
automated_outreach
high_risk_decisions
deploys_chatbot

Read the law

official CAC-published full Chinese statutory text

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app