China’s top internet regulator has issued new rules requiring network operators to report “particularly serious” cybersecurity incidents within one hour.
The new regulation, titled ‘National Cybersecurity Incident Reporting Management Measures,’ is expected to take effect on November 1, 2025. The move follows the recent high-profile case in which Dior’s Shanghai branch was fined for the illegal overseas transfer of customer data, according to The South China Morning Post.
Under the new rules, incidents classified as “particularly serious” must be reported to cyberspace and public security authorities within an hour. Such incidents include extended outages of government or key media portals, massive hacking attacks, and large-scale data leaks such as the breach of over 100 million citizens’ personal records or damages exceeding 100 million yuan ($14 million).
Other scenarios qualifying as “particularly serious” include the disruption of critical services affecting over 10 million people or more than 50% of a province’s population, especially when it involves utilities, healthcare, or transportation.
Authorities receiving such reports must escalate them to the National Cyberspace Administration and the State Council within 30 minutes, the draft says.
Operators will also be required to submit a comprehensive report within 30 days of the incident, detailing causes, impact, response measures, and future improvements.
The new measures build on China’s Cybersecurity Law (2016) and its 2021 rules on protecting critical information infrastructure. The draft amendment introduces specific penalties for non-compliance, with fines up to 10 million yuan for companies and 1 million yuan for responsible individuals, depending on the severity. Fines also apply to operators that fail to remove or report the spread of prohibited content online, with penalties ranging from 50,000 to 500,000 yuan.