China Data Security Law (DSL) 29: Art. 29 Closer risk monitoring, immediate remediation of defects, immediate incident handling with user notification and reporting

Data processing must be subject to closer risk monitoring; where data security defects, vulnerabilities or other risks are discovered remedial measures are taken immediately; where a data security incident occurs measures to handle it are taken immediately and users are notified and reports made to the relevant competent departments in a timely manner according to the relevant provisions (the 2025 Regulations set the incident reporting detail).