Company: HMDCF
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001410578-25-000377
Chunk: 55

Company: HUTCHMED (China) Ltd
Filing Date: 2025-03-19
Form: 20-F
Item: Item 1
Chunk 55
---
 be accessed by unauthorized parties, manipulated, publicly disclosed, lost or stolen. Any such access, breach, or other loss of information relating to our information technology and infrastructure or that of our third-party partners may subject us to reputation damage, increased scrutiny and liability including legal claims or proceedings and liability under federal or state laws that protect the privacy of personal information.

Table of Contents

Regulatory authorities in China have implemented a number of legislative and regulatory proposals concerning data protection. The PRC Cyber Security Law, which became effective in June 2017, created China’s first national-level data protection for “network operators,” which may include all organizations in China that provide services over the internet or another information network. The PRC Data Security Law, which took effect in September 2021, provides for a security review procedure for the data activities that may affect national security. The PRC Personal Information Protection Law, which took effect from November 2021, provides the circumstances under which a personal information processor could process personal information and the requirements for such circumstances. The PRC Personal Information Protection Law clarifies the scope of application, the definition of personal information and sensitive personal information, the legal basis of personal information processing and the basic requirements of notice and consent. The Measures for Cybersecurity Review, which took effect on February 15, 2022, provides that critical information infrastructure operators that purchase network products and services and online platform operators engaging in data processing activities that affect or may affect national security shall be subject to the cybersecurity review, and elaborates the factors to be considered when assessing the national security risks of the relevant activities. The Measures for Cybersecurity Review further stipulates that online platform operators holding personal information of over one million users shall apply with the Cybersecurity Review Office for a cybersecurity review before any public listing in a foreign country. As of the date of this annual report, we have not received any formal notice from any PRC cybersecurity regulator that we should apply for or otherwise be subject to the cybersecurity review, or subject to any investigation or received any inquiry, notice or sanction on cybersecurity review. The exact scope of “critical information infrastructure operators” under the current regulatory regime remains unclear, and the PRC government authorities may have wide discretion in the interpretation and enforcement of the applicable laws. Therefore, it is uncertain whether we would be deemed to be a critical information infrastructure operator under PRC law. If we are deemed to be a critical information infrastructure operator under the PRC cybersecurity laws and regulations, we may be subject to obligations in addition to what we have fulfilled under