An overview of the regulatory requirements governing data breach reporting and notification in China. The Note sets out different scenarios where the government authorities or affected individuals must be notified in the event of a data breach incident involving personal information and the consequences for failure to comply with these requirements. It describes the importance of having an effective data breach management system for businesses and provides practical tips on how to prepare for, and respond to, a data breach incident.

This Note also discusses typical data breach notification clauses under a contractual arrangement.