China Privacy Law PIPL breach response and notification

Start remedial action before every fact is known. Stop continuing disclosure or alteration, preserve relevant logs and systems, secure affected accounts or interfaces, and determine whether the event involves personal information and one of Article 57's states: actual or possible leakage, alteration, or loss. The trigger is broader than a confirmed confidentiality breach because possible leakage, alteration, and loss are expressly included.

The personal information processor remains responsible for the PIPL response. An entrusted processor must protect the information and assist the processor with PIPL duties, so the incident procedure and contract should state who escalates, preserves evidence, investigates, and supplies notice facts.

Article 57 says the notice must describe the categories of information involved, the reason for the actual or possible leakage, alteration, or loss, the possible harm, the processor's remedial measures, steps individuals can take to reduce harm, and the processor's contact details. Use confirmed facts, identify uncertainty, and correct material information as the investigation develops.

The statute permits omission of notice to individuals only when the processor's measures can effectively prevent harm from the event. This exception does not remove notice to the responsible authority, and the authority may still require individual notice if it considers harm possible. A low-risk label by itself does not meet the statutory test; retain evidence showing how the measures effectively avoid harm.

Keep a decision log that links changing facts to containment, notification, individual support, and recovery. Preserve evidence needed to show what happened and why each action was taken without retaining exposed personal information longer than necessary.

After containment, verify that remedial measures work, address individual requests and complaints, update risk and vendor records, and correct the weakness that caused the event. Article 51 requires an incident plan; use the findings to update and test it.