China's New Cyber Incident Reporting Rules

Introduction

Protecting the integrity of networks and data has become a global imperative. China, recognising this, has promulgated the "Administrative Measures for the Reporting of National Cybersecurity Incidents " ("Measures"; effective 1 November 2025). The Measures outline a comprehensive approach to reporting cybersecurity incidents, aiming to minimise losses, incentivise legal compliance, protect national cybersecurity, and align with existing legal frameworks. This article provides an analysis of the Measures' key provisions and offers insights into China's rapidly evolving cybersecurity framework.

Purpose

Article 1 of the draft describes the rationale behind these Measures. It emphasises the Measures' alignment with foundational privacy, data, and cyber security laws in China, such as the Cybersecurity Law, Data Security Law, Personal Information Protection Law, and Regulations on the Protection of the Security of Critical Information Infrastructure.