Company: DDC
Filing Date: 2025-01-28
Form Type: 20-F
Source: 0001213900-25-007160
Chunk: 14

Company: DDC Enterprise Ltd
Filing Date: 2025-01-28
Form: 20-F
Item: Item 3
Chunk 14
---
 and individuals carrying out data activities, and introduces a data classification and hierarchical
protection system based on the importance of data in economic and social development, as well as the degree of harm it will cause to national
security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed,
leaked, or illegally acquired or used. The PRC Data Security Law also provides for a national security review procedure for data activities
that may affect national security and imposes export restrictions on certain data and information. As uncertainties remain regarding the
interpretation and implementation of these laws and regulations, we cannot assure you that we will comply with such regulations in all
respects and we may be ordered to rectify or terminate any actions that are deemed illegal by regulatory authorities. We may also become
subject to fines and/or other sanctions which may have material adverse effect on our business, operations and financial condition.

On August 20, 2021, the
SCNPC promulgated the PRC Personal Information Protection Law, or the PIPL, which took effect in November 2021. In addition to other
rules and principles of personal information processing, the PIPL specifically provides rules for processing sensitive personal information.
Sensitive personal information refers to personal information that, once leaked or illegally used, could easily lead to the infringement
of human dignity or harm to the personal or property safety of an individual, including biometric recognition, religious belief, specific
identity, medical and health, financial account, personal whereabouts and other information of an individual, as well as any personal
information of a minor under the age of 14. Only where there is a specific purpose and sufficient necessity, and under circumstances where
strict protection measures are taken, may personal information processors process sensitive personal information. A personal information
processor shall inform the individual of the necessity of processing such sensitive personal information and the impact thereof on the
individual’s rights and interests apart from the matters of, including without limitation, name and contact number of the processor,
processing purpose and method, type to be processed, preservation period of the information, means and procedures by which individuals
exercise the rights provided by the PIPL. As uncertainties remain regarding the interpretation and implementation of the PIPL, we
cannot assure you that we will comply with the PIPL in all respects and regulatory authorities may order us to rectify or terminate our
current practice of collecting and processing sensitive personal information.

While we take various measures
to comply with all applicable data privacy and protection laws