Company: GDHLF
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001410578-25-000935
Chunk: 198

Company: GDS Holdings Ltd
Filing Date: 2025-04-28
Form: 20-F
Item: Item 4
Chunk 198
---
 and services and data processing activities affect or may affect national security, the Cybersecurity Review Office shall report to the CAC for approval and initiate a cybersecurity review even if the operators do not have an obligation to report for a cybersecurity review under such circumstances. The Cybersecurity Review Measures also elaborated the factors to be considered when assessing the national security risks of the relevant activities, including among others, risks of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or exited the country and risks of critical information infrastructure, core data, important data or a large amount of personal information data being affected, controlled and maliciously used by foreign governments after a foreign listing. Many of the legislations are relatively new and certain concepts thereunder remain subject to interpretation by the regulators. For example, the Cybersecurity Review Measures provides that operators engaging in data processing who hold more than one million users’ individual information and seek listing aboard shall file for cybersecurity review with the Cybersecurity Review Office under the CAC and the concepts of “listing aboard” and “hold” are still unclear. On July 30, 2021, the State Council promulgated the Regulations on Protection of Critical Information Infrastructure, which became effective on September 1, 2021 and defined “critical information infrastructure” as the important network facilities or information systems of key industries or fields, such as public communication and information service, energy, transportation, water conservation, finance, public services, e-government affairs and national defense science, and important network facilities or information systems which may endanger national security, people’s livelihood and public interest once there occur damage, malfunctioning or data leakage to them. The Regulations on Protection of Critical Information Infrastructure provided that no individual or organization may carry out any illegal activity of intruding into, interfering with, or sabotaging any critical information infrastructures, or endanger the security of any critical information infrastructures. The Regulations on Protection of Critical Information Infrastructure also mandated that each critical information infrastructure operator shall establish a cybersecurity protection system and accountability system, and the principal person in-charge of a critical information infrastructure operator shall take full responsibility for the security protection of the critical information infrastructures operated by it. In addition, relevant administration departments of each important industry and sector, or the Protection Departments, shall be responsible for formulating the rule of critical information infrastructure determination applicable to their respective industry or sector, and determine the critical information infrastructure operators in their industry or sector. The result of the determination of critical information infrastructure operator shall be informed to the relevant