ChinaPersonal Information Protection Law, Data Breach Notification
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Upon discovering an actual or possible leak, alteration, or loss of personal information, immediately take remedial measures and notify both the department performing personal information protection duties and the affected individuals; you may omit notice to the individuals where your measures can effectively prevent harm from the leak, alteration or loss, unless that department believes harm may result and requires you to notify them.
- Include in any breach notice the categories of information involved, the cause, possible harm, remedial steps taken, what affected individuals can do to protect themselves, and the handler's contact information.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Within what period must a handler notify the department and the individuals after a leak, tampering or loss occurs or may occur, given that Article 57 requires the remedial measures and the notice 立即 ("immediately")?
- Which measures meet the test in Article 57, 采取措施能够有效避免信息泄露、篡改、丢失造成危害 ("takes measures that can effectively avoid harm caused by the leak, tampering or loss"), so that the handler may omit notice to individuals?
What it makes you log
Logging duty
Article 57 requires a handler that finds an actual or possible leak, alteration or loss of personal information to take remedial measures at once and to notify the protection department and the individuals, setting out what the notice must contain. It does not require the handler to record or register the incident, so it is a duty to notify and not a record duty.
- Kind
- None
- As of
What this law does
Upon discovering an actual or possible leak, tampering, or loss of personal information, a handler must immediately take remedial measures and notify both the department responsible for personal information protection and the affected individuals, with the notice covering the categories of information involved, the cause, possible harm, remedial measures, mitigation steps for individuals, and the handler's contact information.
Individual notice may be omitted where remedial measures can be shown to effectively prevent harm, unless the supervisory department requires notice anyway. The statute requires action taken immediately rather than setting a fixed numeric deadline such as 72 hours.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .