Company: CNTB
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001835268-25-000014
Chunk: 204

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 204
---
 information and expands data protection compliance obligations to cover the processing of personal information of persons by organizations and individuals in the PRC, and the processing of personal information of persons in the PRC outside of the PRC if such processing is for purposes of providing products and services to, or analyzing and evaluating the behavior of, persons in the PRC. The Personal Information Protection Law also provides that critical information infrastructure operators and personal information processing entities who process personal information meeting a volume threshold to be set by PRC cyberspace regulators are also required to store in the PRC personal information generated or collected in the PRC, and to pass a security assessment administered by PRC cyberspace regulators for any export of such personal information. Lastly, the Personal Information Protection Law provides for significant fines for serious violations of up to RMB 50 million or 5% of annual revenues from the prior year and may also be ordered to suspend any related activity or be revoked the relevant business permits or business license by competent authorities. We do not maintain, nor do we intend to maintain, personally identifiable health information of patients in the PRC. We do, however, collect and maintain de-identified health data for clinical trials in compliance with local regulations.

China’s National Information Security Standardization Technical Committee issued the Practice Guidelines for Cybersecurity Standards — Security Certification Specifications for Cross-border Processing of Personal Information on June 24, 2022, and issued Version 2.0 of such guidelines on December 16, 2022, or collectively, the Security Certification Specifications. The Security Certification Specifications serve as guidance for how personal information security certification should be conducted for cross-border transfer of personal information. However, the Security Certification Specifications are only recommended guidelines and compliance is not mandatory.

On February 22, 2023, the CAC issued the Measures for the Standard Contract for Cross-Border Transfer of Personal Information (the “Standard Contract Measures”) along with the formal version of the standard contractual clauses for cross-border transfer of personal information stipulated under the Personal Information Protection Law. The Standard Contract Measures came into effect on June 1, 2023, and provide a six-month grace period. It specifies the applicable scope of, conditions to enter into and detailed filing requirements for standard contracts on cross-border transfer of personal information, which become a part of the compliance mechanism for personal information protection. Any violation of the Standard Contract Measures shall be punished in accordance with the Personal Information Protection Law and other laws and regulations. The Personal Information Protection Law provides punishment measures such as ordering corrections, warnings