Company: GDHLF
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001410578-25-000935
Chunk: 197

Company: GDS Holdings Ltd
Filing Date: 2025-04-28
Form: 20-F
Item: Item 4
Chunk 197
---
 which should be directly related to the processing purpose and should be conducted in a method that has the minimum impact on personal rights and interests, and (ii) the collection of personal information should be limited to the minimum scope as necessary to achieve the processing purpose and avoid the excessive collection of personal information. The PIPL also specifies the rules for handling “sensitive personal information,” which means personal information that, once leaked or illegally used, may easily cause harm to the dignity of natural persons or grave harm to personal or property security, including information on biometric characteristics, financial accounts, individual location tracking.

The Cybersecurity Law of the People’s Republic of China, or the Cybersecurity Law, which was approved by the SCNPC on November 7, 2016 and came into effect on June 1, 2017, provides certain rules and requirements applicable to network service providers in China. The Cybersecurity Law requires network operators to perform certain functions related to cybersecurity protection and strengthen network information management by taking technical and other necessary measures as required by laws and regulations to safeguard the operation of networks, effectively addressing network security, preventing illegal and criminal activities, and maintaining the integrity, confidentiality and usability of network data. In addition, the Cybersecurity Law imposes certain requirements on network operators of critical information infrastructure, including that such network operators with operations in the PRC shall store personal information and important data collected and produced within the territory of PRC, and shall perform certain security obligations as required under the Cybersecurity Law.

Table of Contents

On December 28, 2021, the Cyberspace Administration of China, or the CAC, the NDRC, the MIIT, the MPS, the Ministry of State Security, the Ministry of Finance, the MOFCOM, the PBOC, the SAMR, the National Radio and Television Administration, or the NRTA, the CSRC, the State Secrecy Administration and the State Cryptography Administration jointly promulgated the Cybersecurity Review Measures, which came into effect on February 15, 2022. The Cybersecurity Review Measures provides that, among others, a critical information infrastructure operator which engages in data processing activities or an online platform operator conducts data processing, either of which affects or may affect national security shall be subject to the cybersecurity review. In addition to the abovementioned circumstance under which the relevant operators are mandatorily imposed with the obligation to apply for cybersecurity reviews, the Cybersecurity Review Measures also provides that if the members of the cybersecurity review working mechanism consider that certain network products