Company: DDC
Filing Date: 2025-08-05
Form Type: F-3/A
Source: 0001213900-25-072059
Chunk: 50

Company: DDC Enterprise Ltd
Filing Date: 2025-08-05
Form: F-3/A
Chunk 50
---
 Providers are also obliged to provide security maintenance for their products and services and shall comply
with provisions regarding the protection of personal information as stipulated under the relevant laws and regulations. The Civil Code
of the PRC (issued by the PRC National People’s Congress on May 28, 2020 and effective from January 1, 2021) provides
main legal basis for privacy and personal information infringement claims under the Chinese civil laws. PRC regulators, including the
Cyberspace Administration of China, MIIT, and the Ministry of Public Security have been increasingly focusing on regulation in the areas
of data security and data protection. The PRC regulatory requirements regarding cybersecurity are constantly evolving. For instance, various
regulatory bodies in China, including the Cyberspace Administration of China, the Ministry of Public Security and State Administration
for Market Regulation, or the SAMR, have enforced data privacy and protection laws and regulations with varying and evolving standards
and interpretations. On November 14, 2021, the Cyberspace Administration of China, or the CAC, issued the Draft Cyber Data Security
Regulations for public comments, pursuant to which, data processors carrying out the following activities must, in accordance with the
relevant national regulations, apply for a cybersecurity review: (i) the merger, reorganization or spin-off of internet platform
operators that possess a large number of data resources related to national security, economic development and public interests that affects
or may affect national security; (ii) listing in a foreign country of data processors that process the personal information of more
than one million users; (iii) listing in Hong Kong of data processors that affect or may affect national security; and (iv) other
data processing activities that affect or may affect national security. The scope of and threshold for determining what “affects
or may affect national security” is still subject to uncertainty and further elaboration by the CAC. On December 28, 2021,
the CAC, and 12 other relevant PRC government authorities published the amended Cybersecurity Review Measures, which came into effect
on February 15, 2022. The final Cybersecurity Review Measures provide that a “network platform operator” that possesses personal
information of more than one million users and seeks a listing in a foreign country must apply for a cybersecurity review. Further, the
relevant PRC governmental authorities may initiate a cybersecurity review against any company if they determine certain network products,
services or data processing activities of such company affect or