Company: SDAWW
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001213900-25-036086
Chunk: 45

Company: SunCar Technology Group Inc.
Filing Date: 2025-04-28
Form: 20-F
Item: Item 3
Chunk 45
---
 reputational damage that materially impacts our operations
and financial results.

Recently, regulatory authorities
in China have enhanced data protection and cybersecurity regulatory requirements, many of which are subject to change and uncertain interpretation.
These laws continue to develop, and the PRC government may adopt further rules, restrictions and clarifications in the future. Moreover,
different PRC regulatory bodies, including the Standing Committee of the National People’s Congress (or the “ SCNPC”),
the MIIT, the Cyberspace Administration of China (or the “ CAC”), the Ministry of Public Security (or the “ MPS”)
and the State Administration for Market Regulation (or the “ SAMR”), have enforced data privacy and protections laws and regulations
with varying standards and applications. The following are non-exhaustive examples of certain recent PRC regulatory activities in this
area:

On June 10, 2021, the Standing
Committee of the National People’s Congress of China promulgated the PRC Data Security Law, which became effective in September
2021. The PRC Data Security Law provides for data security and privacy obligations on entities and individuals carrying out data processing
activities, introduces a data classification and hierarchical protection system based on the importance of data, and imposes export restrictions
on certain data and information.

On August 20, 2021, the Standing
Committee of the National People’s Congress of China issued the PRC Personal Information Protection Law, which took effective in
November 2021 and integrates the scattered rules with respect to personal information rights and privacy protection. The PRC Personal
Information Protection Law aims at protecting personal information rights and interests, regulating the processing of personal information,
and promoting the reasonable use of personal information.

On December 28, 2021, the
CAC and several other administrations jointly promulgated the Review Measures, which became effective on February 15, 2022. According
to the Review Measures, an issuer who is a network platform operator holding personal information of more than one million shall file
for a cybersecurity review with respect to its proposed listing on a foreign stock exchange, and the relevant PRC governmental authorities
may initiate cybersecurity review if such governmental authorities determine that the issuer’s data processing activities affect
or may affect national security. However, the Review Measures provides no further explanation on the determination of “affects or
may affect national security.” As of the date of this annual report, we have not been involved in any cybersecurity-related investigation
or received any cybersecurity-related warning from the PRC