Company: GDHLF
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001410578-25-000935
Chunk: 196

Company: GDS Holdings Ltd
Filing Date: 2025-04-28
Form: 20-F
Item: Item 4
Chunk 196
---
 Administrative Measures for the Hierarchical Protection of Information Security, which divides information systems into five categories and requires the operators of information systems ranking above Grade II to file an application with the local Bureau of Public Security within 30 days of the date of its security protection grade determination or since its operation.

The PRC government regulates the security and confidentiality of internet users’ information. The Administrative Measures on Internet Information Servicepromulgated by the State Council on September 25, 2000 and respectively amended on January 8, 2011 and December 6, 2024, the Regulations on Technical Measures of Internet Security Protectionpromulgated by the MPS on December 13, 2005 and the Provisions on Protecting Personal Information of Telecommunication and Internet Userspromulgated by the MIIT on July 16, 2013 set forth strict requirements to protect personal information of internet users and require internet information service providers to maintain adequate systems to protect the security of such information. Personal information collected must be used only in connection with the services provided by the internet information service provider. Moreover, the Rules for Regulating the Order in the Market for Internet Information Servicewhich was promulgated by the MIIT on December 29, 2011 and came into effect on March 15, 2012 also protect internet users’ personal information by (i) prohibiting internet information service providers from unauthorized collection, disclosure or use of their users’ personal information and (ii) requiring internet information service providers to take measures to safeguard their users’ personal information.

Pursuant to the PRC Civil Code, the personal information of a natural person shall be protected by the law. Any organization or individual shall legally obtain such personal information of others when necessary and ensure the safety of such information, and shall not illegally collect, use, process or transmit personal information of others, or illegally purchase or sell, provide or make public personal information of others.

The Personal Information Protection Law, or the PIPL, which was promulgated by the SCNPC on August 20, 2021 and took effect on November 1, 2021, provides detailed rules for processing personal information and further improves the personal information protection system. It aims at protecting the personal information rights and interests, regulating the processing of personal information, ensuring the orderly and free flow of personal information in accordance with the law and promoting the reasonable use of personal information. The PIPL requires, among others, that (i) the processing of personal information should have a clear and reasonable purpose