Company: SOS
Filing Date: 2025-06-25
Form Type: F-3/A
Source: 0001213900-25-057886
Chunk: 21

Company: SOS Ltd
Filing Date: 2025-06-25
Form: F-3/A
Chunk 21
---
: (1) merger, reorganization or spin-off of Internet platform operators holding a large amount of data resources related
to national security, economic development or public interests, which may have an adverse effect on national security; (2) data processors
intending to list their securities on a foreign stock exchange that handle personal information of more than one million people; (3) data
processors intending to list their securities on a stock exchange in Hong Kong which may have an adverse effect on national security;
and (4) other data processing activities that may have an adverse effect on national security.

On December 28, 2021, the CAC, jointly with 12
other governmental authorities, promulgated the revised Cybersecurity Review Measures (2021), which became effective on February 15, 2022.
According to the Cybersecurity Review Measures (2021), critical information infrastructure operators that intend to purchase internet
products and services which may have an adverse effect on national security must apply for cybersecurity review. Meanwhile, online platform
operators holding personal information of over one million users that intend to list their securities on a foreign stock exchange must
apply for cybersecurity review. In the meantime, the governmental authorities have the discretion to initiate a cybersecurity review on
any data processing activity if they deem such a data processing activity affects or may affect national security. The specific implementation
rules on cybersecurity review are subject to further clarification by subsequent regulations.

On July 7, 2022, the CAC promulgated the Measures
for the Security Assessment of Cross-Border Transfer of Data, which took effect on September 1, 2022. These measures aim to regulate cross-border
transfers of data, requiring among other things, that data processors that provide data to overseas apply to CAC for security assessments
if: (1) data processors provide important data to overseas parties; (2) critical information infrastructure operators and data processors
process personal information of more than one million individuals provide personal information to overseas parties; (3) data processors
that have cumulatively provided personal information of 100,000 people or sensitive personal information of 10,000 people to overseas
parties since January 1 of the previous year, provide personal information to overseas parties; and (4) other scenarios required by the
CAC to apply for security assessments are met. In addition, these measures require data processors to carry out self-assessments of risks
of providing data to overseas parties before applying to the CAC for security assessments.

As of