Company: APM
Filing Date: 2025-04-30
Form Type: 20-F
Source: 0001213900-25-037669
Chunk: 88

Company: Aptorum Group Ltd
Filing Date: 2025-04-30
Form: 20-F
Item: Item 3
Chunk 88
---
 Law, which was adopted by the Standing Committee of the National People’s
Congress on November 7, 2016 and came into force on June 1, 2017, and the Cybersecurity Review Measures, or the “ Review Measures”,
provide that personal information and important data collected and generated by a critical information infrastructure operator in the
course of its operations in mainland China must be stored in mainland China, and if a critical information infrastructure operator purchases
internet products and services that affect or may affect national security, it should be subject to national security review by the CAC
together with competent departments of the State Council. In addition, for critical information infrastructure operators, or the “ CIIOs”,
that purchase network-related products and services, the CIIOs shall declare any network-related product or service that affects or may
affect national security to the Office of Cybersecurity Review of the CAC for cybersecurity review. Due to the lack of further interpretations,
the exact scope of what constitutes a “ CIIO” remains unclear. Further, the PRC government authorities may have wide discretion
in the interpretation and enforcement of these laws. In addition, the Review Measures stipulates that any online platform operators holding
more than one million users/users’ individual information shall be subject to cybersecurity review before listing abroad. As of
the date of the annual report, neither we nor our subsidiaries have received any notice from any authorities identifying us or our subsidiaries
as a CIIO or requiring us or our subsidiaries to undertake a cybersecurity review by the CAC. Further, as of the date of the annual report,
neither we nor our subsidiaries have been subject to any penalties, fines, suspensions, or investigations from any competent authorities
for violation of the regulations or policies that the CAC has issued.

On June 10, 2021, the Standing
Committee of the National People’s Congress promulgated the Data Security Law, which took effect on September 1, 2021. The Data
Security Law requires that data shall not be collected by theft or other illegal means, and it also provides for a data classification
and hierarchical protection system. The data classification and hierarchical protection system protects data according to its importance
in economic and social development, and the damages it may cause to national security, public interests, or the legitimate rights and
interests of individuals and organizations if the data is falsified, damaged, disclosed, illegally obtained or illegally used, which protection
system is expected to be built by the state for