Company: IMG
Filing Date: 2025-07-30
Form Type: 10-K/A
Source: 0001641172-25-021542
Chunk: 48

Company: CIMG Inc.
Filing Date: 2025-07-30
Form: 10-K/A
Chunk 48
---
 interpretation come into effect, we will take all reasonable measures and actions to comply and to minimize the adverse effect of such laws on us. We cannot guarantee, however, that we will not be subject to cybersecurity review and network data security review in the future, which could materially and adversely affect our business, financial conditions, and results of operations.

Compliance with China’s new Data Security Law, Measures on Cybersecurity Review (revised draft for public consultation), Personal Information Protection Law (second draft for consultation), regulations and guidelines relating to the multi-level protection scheme and any other future laws and regulations may entail significant expenses and could materially affect our business.

China has implemented or will implement rules and is considering a number of additional proposals relating to data protection. China’s new Data Security Law promulgated by the Standing Committee of the National People’s Congress of China in June 2021, or the Data Security Law, will take effect in September 2021. The Data Security Law provides that the data processing activities must be conducted based on “data classification and hierarchical protection system” for the purpose of data protection and prohibits entities in China from transferring data stored in China to foreign law enforcement agencies or judicial authorities without prior approval by the Chinese government. As the Data Security Law has not yet come into effect, we may need to make adjustments to our data processing practices to comply with this law.

| 37 |

Additionally, China’s Cyber Security Law, requires companies to take certain organizational, technical and administrative measures and other necessary measures to ensure the security of their networks and data stored on their networks. Specifically, the Cyber Security Law provides that China adopt a multi-level protection scheme (MLPS), under which network operators are required to perform obligations of security protection to ensure that the network is free from interference, disruption or unauthorized access, and prevent network data from being disclosed, stolen or tampered. Under the MLPS, entities operating information systems must have a thorough assessment of the risks and the conditions of their information and network systems to determine the level to which the entity’s information and network systems belong-from the lowest Level 1 to the highest Level 5 pursuant to the Measures for the Graded Protection and the Guidelines for Grading of Classified Protection of Cyber Security. The grading result will determine the set of security protection obligations that entities must comply with. Entities classified as Level 2 or above should report the grade to the relevant government authority for examination and approval.

Recently, the Cyberspace Administration of China has taken action against several Chinese internet companies in connection with their initial public