Company: SSEA
Filing Date: 2025-04-11
Form Type: DRS/A
Source: 0001829126-25-002569
Chunk: 133

Company: STARRY SEA ACQUISITION CORP
Filing Date: 2025-04-11
Form: DRS/A
Chunk 133
---
 The PRC Data Security Law also provides for a national security review procedure for data activities that may affect national security and imposes export restrictions on certain data. In July 2021, the State Council of the PRC promulgated the Regulations on the Protection of the Security of Critical Information Infrastructure, which became effective on September 1, 2021. Pursuant to this regulation, critical information infrastructure means key network facilities or information systems of critical industries or sectors, such as public communication and information service, energy, transportation, water conservation, finance, public services, e-government affairs and national defense science, the damage, malfunction or data leakage of which may endanger national security, people’s livelihoods and the public interest.

<div align='center'>79</div>

On August 20, 2021, the SCNPC passed the PRC Personal Information Protection Law (the “PIPL”), which took effect on November 1, 2021. The PIPL accentuates the importance of processors’ obligations and responsibilities for personal information protection and sets out the basic rules for processing personal information and the rules for cross-border transfer of personal information. Pursuant to the PIPL, a personal information processor is allowed to process (including to collect, store, use, process, transmit, provide, disclose and delete) personal information only under certain circumstances, such as processing with consent from such individual, or for the necessity of performance of a contract to which such individual is a contracting party or statutory duties, management of human resource under the labor rules and regulations developed in accordance with the law or a collective contract signed in accordance with the law, protection of public interest, or reasonable usage of legally disclosed information. Processing of sensitive personal information, such as the personal information that may easily result in damage to personal dignity, personal or property safety once leaked or illegally used, as well as the personal information of minors under the age of 14, is subject to higher regulatory requirements including specific purpose, sufficient necessity, duty of explanation to such individuals and consent from a parent or a guardian of such minors.

On September 24, 2024, the State Council published the Regulations on Network Data Security Management (the “Network Data Security Regulations”), which became effective on January 1, 2025. The Network Data Security Regulations provide that network data processors refer to individuals or organizations that autonomously determine the purpose and the manner of processing network data, and the network data processors engaging in data processing activities that affect or may affect national security shall be subject to the national security review in