Company: GLXG
Filing Date: 2025-10-24
Form Type: 20-F
Source: 0001213900-25-102144
Chunk: 5

Company: Galaxy Payroll Group Ltd
Filing Date: 2025-10-24
Form: 20-F
Item: Item 3
Chunk 5
---
 for alleged national security risks and improper collection and use of the personal information of Chinese
data subjects. According to the official announcement, the action was initiated based on the National Security Law, the Cyber Security
Law and the Cybersecurity Review Measures, which are aimed at “preventing national data security risks, maintaining national security
and safeguarding public interests.” On December 28, 2021, the Cyberspace Administration of China and other PRC authorities promulgated
the Cybersecurity Review Measures, which took effect on February 15, 2022. The Cybersecurity Review Measures further restates and expands
the applicable scope of the cybersecurity review in effect. Pursuant to the Cybersecurity Review Measures, critical information infrastructure
operators that procure internet products and services and network platform operators engaging in data processing activities must be subject
to the cybersecurity review if their activities affect or may affect national security. The Cybersecurity Review Measures further stipulates
that network platform operators holding personal information of over one million users must apply to the Cybersecurity Review Office for
a cybersecurity review before a foreign listing.

As of the date of this report,
we do not believe we currently are among the network platform operators holding personal information of over one million users, as mentioned
above. Uncertainties still exist, however, due to the possibility that laws, regulations, or policies in the PRC could change rapidly
in the future. Any future action by the PRC government expanding the categories of industries and companies whose foreign securities offerings
are subject to review by the Cyberspace Administration of China could significantly limit or completely hinder our ability to offer or
continue to offer securities to investors and could cause the value of such securities to significantly decline or be worthless.

Also, on August 20,
2021, the National People’s Congress passed the Personal Information Protection Law, which took effect on November 1, 2021.
The law creates a comprehensive set of data privacy and protection requirements that apply to the processing of personal information and
expands data protection compliance obligations to cover the processing of personal information of persons by organizations and individuals
in China, and the processing of personal information of persons in China outside of China if such processing is for purposes of providing
products and services to, or analyzing and evaluating the behavior of, persons in China. The law also proposes that critical information
infrastructure operators and personal information processing entities who process personal information meeting a volume threshold to-be-set
by Chinese cyberspace regulators are also required to store in China personal information