Company: GDHLF
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001410578-25-000935
Chunk: 102

Company: GDS Holdings Ltd
Filing Date: 2025-04-28
Form: 20-F
Item: Item 3
Chunk 102
---
 during the Fourteenth Five-Year Plan period shall be deducted at the time of assessment of total national and regional energy consumption, which is an important measure for the “ Dual-Control” targets. These laws and regulations may compel us to source more renewable energy, and we may be unable to do on commercially acceptable terms. Compliance with such laws or regulations may require us to incur material capital expenditures or other obligations or liabilities.

Table of Contents

The PRC Cybersecurity Law and Data Security Law are relatively new, and subject to change and uncertain interpretation by regulators. These laws may result in claims, penalties, changes to our business practices, increased cost of operations, damages to our reputation and brand, or otherwise harm our business.

Additionally, the Cybersecurity Law came into effect on June 1, 2017, which provides certain rules and requirements applicable to network service providers in mainland China. The Cybersecurity Law requires network operators to perform certain functions related to cybersecurity protection and the strengthening of network information management through taking technical and other necessary measures as required by laws and regulations to safeguard the operation of networks, responding to network security effectively, preventing illegal and criminal activities, and maintaining the integrity and confidentiality and usability of network data. However, the Cybersecurity Law still leaves a series of gaps to be filled due to the complex and sensitive nature of this regulatory area. While the Cybersecurity law sets out a broad set of principles, certain key terms and clauses are uncertain and ambiguous, which appear intended to be clarified through a series of laws, implementing regulations and guidelines to be issued by relevant authorities. Numerous regulations, guidelines and other measures have been and are expected to be adopted under the Cybersecurity Law. For more details, see “ Item 4. Information on the Company - B. Business Overview - Regulatory Matters Related to Our Business - People’s Republic of China Regulations - Regulations Related to Information Security and Confidentiality of User Information.” Currently, the Cybersecurity Law and relevant regulations, guidelines and other measures have not directly impacted our operations, but in light of rapid advances in its implementation, we believe the implementation of the Cybersecurity Law involves potential risks to our business because we may be deemed as the network operator of critical information infrastructure thereunder.

Furthermore, the PRC regulatory and enforcement regime with regard to data security and data protection has continued to evolve. There are uncertainties on how certain laws and regulations will be implemented in practice. PRC regulators have been increasingly focused on regulating data security and data protection. We expect that these areas will receive greater attention from regulators, as well as attract