Law note · China
Personal Information Protection Law, Data Breach Notification
Upon discovering an actual or possible leak, tampering, or loss of personal information, a handler must immediately take remedial measures and notify both the department responsible for personal information protection and the affected individuals, with the notice covering the categories of information involved, the cause, possible harm, remedial measures, mitigation steps for individuals, and the handler's contact information.
Individual notice may be omitted where remedial measures can be shown to effectively prevent harm, unless the supervisory department requires notice anyway. The statute requires action taken immediately rather than setting a fixed numeric deadline such as 72 hours.
What it asks of an app
- Upon discovering an actual or possible leak, alteration, or loss of personal information, immediately take remedial measures and notify both the competent personal information protection department and every affected individual, unless the remedial measures can be shown to effectively prevent harm.
- Include in any breach notice the categories of information involved, the cause, possible harm, remedial steps taken, what affected individuals can do to protect themselves, and the handler's contact information.
When LexLint raises it
Declared activities: crawls_web, trains_models, processes_voice, processes_biometrics, automated_outreach, high_risk_decisions, deploys_chatbot
Primary source: official CAC-published full Chinese statutory text