Company: GLXG
Filing Date: 2025-10-24
Form Type: 20-F
Source: 0001213900-25-102144
Chunk: 118

Company: Galaxy Payroll Group Ltd
Filing Date: 2025-10-24
Form: 20-F
Item: Item 4
Chunk 118
---

effect on June 1, 2017. In accordance with the Cyber Security Law, network operators must comply with applicable laws and regulations
and fulfill their obligations to safeguard network security in conducting business and providing services. Network service providers must
take technical and other necessary measures as required by laws, regulations, and mandatory requirements to safeguard the operation of
networks, respond to network security effectively, prevent illegal and criminal activities, and maintain the integrity, confidentiality
and usability of network data.

On December 28, 2021, the
Cyberspace Administration of China and other PRC authorities promulgated the Cybersecurity Review Measures, which took effect on February
15, 2022, and further restates and expands the applicable scope of the cybersecurity review in effect. Pursuant to the Cybersecurity Review
Measures, critical information infrastructure operators that procure internet products and services and network platform operators engaging
in data processing activities must be subject to the cybersecurity review if their activities affect or may affect national security.
The Cybersecurity Review Measures further stipulates that network platform operators holding personal information of over one million
users must apply to the Cybersecurity Review Office for a cybersecurity review before an overseas listing.

On July 30, 2021, the State
Council issued the Regulations on Protection of Critical Information Infrastructure, or the Regulations. Pursuant to the Regulations,
critical information infrastructure shall mean the important network facilities or information systems of key industries or fields such
as public communication and information service, energy, transportation, water conservation, finance, public services, e-government affairs
and national defense science, and important network facilities or information systems which may endanger national security, people’s
livelihood and public interest once there occur damage, malfunctioning or data leakage to them. The Regulations provide that no individual
or organization may carry out any illegal activity of intruding into, interfering with, or sabotaging any critical information infrastructures,
or endanger the security of any critical information infrastructures. The Regulations also require that critical information infrastructure
operators shall establish a cybersecurity protection system and accountability system, and that the main responsible person of a critical
information infrastructure operator shall take full responsibility for the security protection of the critical information infrastructures
operated by it. In addition, relevant administration departments of each important industry and sector shall be responsible for formulating
the rule of critical information infrastructure determination applicable to their respective industry or sector and determine the critical
information infrastructure operators in their industry or sector.

Regulations Relating to PRC Taxation

Enterprise