If user information on the website or app leaks, remedy it at once, notify the users and the authority, and report an attack to the police

If user information leaks, or may leak, you remedy it at once and notify the authority in charge and the users who are affected. If you cover it up and do not report, you are first ordered to correct. If you do not correct, the fine is up to 1000000 yuan, and a serious case is a fine of up to 50000000 yuan. If a user is harmed by it, you pay unless you can prove you were not at fault. If you had protections in place, handled it under the plan, and reported in time, the case can be treated more lightly, or not pursued, depending on the circumstances.

Cost

It costs nothing. Write a plan in advance for the day something happens: who decides, which hole to plug first, and how the notice to users is worded. The hard part is that the instinct in that moment is to cover it up and not let the users know.

Benefit

The Personal Information Protection Law says: "Where a leak, alteration, or loss of personal information occurs or may occur, the personal-information handler shall immediately take remedial measures, and notify the department performing personal-information protection duties and the individuals." The notice has to write 3 things: which kind of information leaked, the cause, and the harm that may follow; what remedy you took, and what the user can do to reduce the harm; and your contact details. If your remedy really can avoid the harm, you may skip notifying the user. But if the authority believes harm may result, it has the right to require you to notify. The Regulations on the Administration of Network Data Security say the notice may use "a telephone call, a text message, an instant-messaging tool, email, or a public announcement." If while handling it you find a lead that a crime may be involved, report it to the public security organ and the state security organ. If you do not perform these duties, you are ordered to correct, warned, and the illegal gains are confiscated, and an app that broke the rule can be ordered to suspend or end the service. If you refuse to correct, the fine is up to 1000000 yuan, and the person directly in charge is fined 10000 to 100000 yuan. In a serious case, the fine is up to 50000000 yuan or up to 5% of the previous year's turnover, and the person in charge is fined 100000 to 1000000 yuan. On the civil side, if a user is harmed by this, you "shall bear tort liability such as damages if you cannot prove that you were not at fault." A leak on a large scale also has to be reported on time. The measures of the Cyberspace Administration of China provide that a leak of personal information of 1000000 or more people counts as a "fairly large cybersecurity incident." For this kind of incident, an ordinary website or app reports to the cyberspace department of the province where it is, "no later than 4 hours," and a channel for it is the 12387 hotline. Within 30 days after the handling ends, you also submit a summary report. Late reporting, omitted reporting, false reporting, or concealed reporting that causes a serious harmful result is punished more heavily. The other way around: if reasonable and necessary protection was already in place, the case was handled under the plan, and it was reported in time, "it may be treated more lightly, or not pursued, depending on the circumstances" (nationwide, the reporting measures from November (11) 2025).

Notes

A small site that leaks several hundred people, or several thousand, still has to remedy and notify under the Personal Information Protection Law. It just does not reach the 4-hour reporting line. When you notify users, write the things they can do in concrete terms: which password to change, and to watch for a phone call from someone pretending to be customer service. Keep logs for a full 6 months, so that when something happens you can see where it leaked. See section 11, item 16 (keep logs as graded protection requires). How users protect themselves after a leak is in section 14.

Sources · 4

1. 全国人大常委会 (2021). 个人信息保护法（第五十七、六十六、六十九条）. spp.gov.cn/spp/fl/202108/t20210820_527244.shtml
2. 全国人大常委会 (2025). 网络安全法（2025 年修正，2026 年 1 月 1 日施行，第二十七、四十四、七十一条；2016 年文本为第二十五、四十二条）. cac.gov.cn/2025-12/29/c_1768735112911946.htm
3. 国务院 (2024). 网络数据安全管理条例（国务院令第 790 号，第十一条）. gov.cn/gongbao/2024/issue_11646/202410/conten…
4. 国家互联网信息办公室 (2025). 国家网络安全事件报告管理办法（第四、八、九、十、十一条，附件《网络安全事件分级指南》）. cac.gov.cn/2025-09/15/c_1759583017717009.htm