Company: XTKG
Filing Date: 2025-04-25
Form Type: 20-F
Source: 0001213900-25-035626
Chunk: 104

Company: X3 Holdings Co., Ltd.
Filing Date: 2025-04-25
Form: 20-F
Item: Item 4
Chunk 104
---
, including penalties, fines, and/or suspension of relevant business or revocation of the business license.

On July 7,
2022, the Cyberspace Administration of China (“ CAC”) promulgated the Measures for Security Assessment for Cross-border Data
Transfer (the “ Measures”), which took effect on September 1, 2022. According to the Measures, a data processor shall
apply to the competent cyberspace department for security assessment and clearance of the outbound data under any of the following circumstances:
(i) outbound transfer of important data by a data processor; (ii) outbound transfer of personal information by an operator of
critical information infrastructure or a data processor which has processed more than one million users’ personal data; (iii) outbound
transfer of personal information by a data processor which has made outbound transfers of more than one hundred thousand users’
personal information or more than ten thousand users’ sensitive personal information cumulatively since January 1 of the previous year;
or (iv) such other circumstances where ex-ante security assessment and evaluation of cross-border data transfer is required by the
CAC. A data processor shall, before applying for the security assessment of an outbound data transfer, conduct a self-assessment of the
risks involved in the outbound data transfer.

Personal Information Protection Law

In August 2021,
the SCNPC promulgated the Personal Information Protection Law, which became effective on November 1, 2021. The Personal Information
Protection Law specifies the rules for processing sensitive personal information, which means personal information that, once leaked
or illegally used, may easily cause harm to the dignity of natural persons or grave harm to personal or property security, including,
but not limited to, information on biometric characteristics, financial accounts, and individual location tracking, as well as the personal
information of minors under the age of 14. Personal information processors shall bear responsibility for their personal information handling
activities and adopt the necessary measures to safeguard the security of the personal information they process. Otherwise, the personal
information processors will be ordered to correct or suspend or terminate the provision of services and be subject to confiscation of
illegal income, fines or other penalties.

Regulations Related to Labor and Social
Security

Pursuant to the Labor Law,
promulgated by National People’s Congress in January 1995, and the Labor Contract Law, promulgated by Standing Committee of the
National People’s Congress in June 2007 and amended in December 2012, employers must execute written