Chinese supplier leaked personal data: what now?
Stop further access, preserve evidence and establish when your business became aware of the breach. Assess harm to customers and staff, record your decisions and report to the ICO if required, without waiting for the supplier's full investigation. Cambridge China Bridge can help gather supplier-side facts through its staff in China.
Contain access and preserve evidence
Appoint an incident owner and involve your data protection lead and technical support. Suspend affected supplier accounts, revoke shared links and active sessions, and replace exposed credentials. Pause transfers of customer or staff files through the affected channel. Use a verified contact route to reach the factory, especially if its email account may be compromised.
Ask the supplier to preserve access logs, original messages and file-sharing records before cleaning up. Request removal of exposed copies and written confirmation of what was removed, from where and by whom. Preserve evidence securely without circulating the leaked dataset. Use the factory system access guide when reviewing permissions.
Establish the timeline and reporting owner
Record separately when the exposure began, when the supplier discovered it, when it notified you and when your business became aware of the breach. Keep original timestamps and time zones alongside a consistent incident timeline. Distinguish confirmed facts from estimates and unanswered questions. Ask who accessed, downloaded or forwarded the information, including subcontractors.
Check whether your business is the controller for the affected data rather than assuming the supplier owns the reporting decision. If the supplier acts as your data processor, it must notify you without undue delay after becoming aware. For your reportable breach, notify the ICO without undue delay and no later than 72 hours after becoming aware. Waiting for a factory investigation does not restart that clock.
Assess harm to people
List the exposed fields and affected groups: delivery contacts, customer order histories, staff identity documents, payroll details or health information. Consider whether people can be identified, who received the data, whether it was readable and what misuse is plausible. Assess the likelihood and severity of fraud, targeted phishing, distress or threats to personal safety. A supplier's assurance that nobody used it is not evidence of containment.
The ICO reporting decision concerns risk to people's rights and freedoms. If risk is likely, report; if unlikely, document why reporting is unnecessary. Inform affected people directly without undue delay where high risk is likely. These are separate decisions: a breach can require an ICO report without requiring notification to individuals.
Report with what you know
Follow the ICO's breach response process: use its self-assessment tool if needed, then its online reporting route for a reportable breach. Prepare an incident summary, timeline, affected data categories, estimated scope, risk assessment, containment actions and a contact person. Clearly label unknowns and assign someone to investigate each gap.
Do not wait for complete factory records before reporting. The ICO allows information to follow in phases without undue further delay. Keep the submission acknowledgement and reference with your incident file. If reporting is late, give reasons for the delay. When contacting affected people, explain what happened, likely consequences, protective actions and where they can get help in plain language.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Keep the decision record and control reopening
Keep a record of every personal data breach, including those not reported. Record the facts, effects and remedial action. Add the evidence behind each risk assessment, who approved the reporting and notification decisions, outstanding uncertainties and what would trigger reassessment. Keep copies of supplier messages, submissions and updates in a restricted incident file.
Before restoring access, ask for evidence that the exposure route is closed and test the revised permissions. Reduce the data supplied to what the factory actually needs. Review the personal data sharing guide and your confidentiality arrangements. Cambridge China Bridge's staff in China can help obtain factory records and check corrective actions; retain a named owner for your business's breach decisions.
Frequently asked questions
Does every supplier data leak need an ICO report?
No. Report where risk to people's rights and freedoms is likely. If risk is unlikely, record the breach and your reasons for not reporting.
When does the 72-hour reporting clock start?
It starts when your business becomes aware of the breach, rather than when the leak occurred. Report without undue delay; do not wait for the supplier's final investigation.
Can I report before the supplier gives me all the facts?
Yes. Report what you know, identify the gaps and provide further information without undue further delay. Keep the acknowledgement with your incident record.
Must I tell affected customers and staff?
Inform them directly without undue delay if the breach is likely to create high risk to their rights and freedoms. Record this assessment separately from the ICO reporting decision.