Company: APM
Filing Date: 2025-07-15
Form Type: DRS
Source: 0001213900-25-063906
Chunk: 138

Company: Aptorum Group Ltd
Filing Date: 2025-07-15
Form: DRS
Chunk 138
---
 the National People’s Congress promulgated the Data Security Law, which took effect on September 1, 2021. The Data Security Law requires that data shall not be collected by theft or other illegal means, and it also provides for a data classification and hierarchical protection system. The data classification and hierarchical protection system protects data according to its importance in economic and social development, and the damages it may cause to national security, public interests, or the legitimate rights and interests of individuals and organizations if the data is falsified, damaged, disclosed, illegally obtained or illegally used, which protection system is expected to be built by the state for data security in the near future. On November 14, 2021, CAC published the Regulations on the Data Security Administration Draft, or the “Data Security Regulations Draft”, to solicit public opinion and comments. Under the Data Security Regulations Draft, an overseas initial public offering to be conducted by a data processor processing the personal information of more than one million individuals shall apply for a cybersecurity review. Data processor means an individual or organization that independently makes decisions on the purpose and manner of processing in data processing activities, and data processing activities refers to activities such as the collection, retention, use, processing, transmission, provision, disclosure, or deletion of data. Currently we do not expect the Review Measures to have an impact on the business and operations of our Hong Kong subsidiaries, because (i) our Hong Kong subsidiaries are incorporated and operating in Hong Kong without any subsidiary or variety interest entity (“VIE”) structure in mainland China, and it is unclear whether the Review Measures shall be applied to a Hong Kong company; (ii) as of the date of hereof, our Hong Kong subsidiaries have not collected or stored personal information of any individual clients of mainland China; and (iii) as of the date hereof, our Hong Kong subsidiaries have not been informed by any PRC governmental authority of any requirement that it file for a cybersecurity review for the offering. Based on laws and regulations currently in effect in the PRC as of the date hereof, we believe our Hong Kong subsidiaries are not required to pass the cybersecurity review of the CAC in order to list Aptorum Class A ordinary shares in the U.S. In addition, on February 17, 2023, the CSRC promulgated the Trial Administrative Measures of Overseas Securities Offering and Listing by Domestic Companies, or the Trial Measures, and five supporting guidelines, which came into effect on March 31, 2023. Pursuant to the Trial Measures