The Cybersecurity Administration of China (CAC)
recently released a consultation draft of the Administrative Measures on
the Reporting of Cybersecurity Incidents
(Measures), together with the Guidelines on
Grading of Cybersecurity Incidents (Guidelines)
and the Reporting Form of Cybersecurity Incident Information
(Reporting Form). The drafts are
open for public comment until 7 January 2024. Once effective, they
will provide much-needed clarity for practitioners and businesses
in China on when and how to report a cybersecurity incident.
Cybersecurity incidents are common, but companies have
difficulties in practice complying with the reporting obligations
in the existing laws and regulations. The current regime lacks
specified reporting timelines, practical reporting requirements and
designated reporting authorities. In addition, the existing laws
and regulations do not specify any reporting thresholds, which
means that even a very small incident is required to be
