Company: GDHLF
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001410578-25-000935
Chunk: 232

Company: GDS Holdings Ltd
Filing Date: 2025-04-28
Form: 20-F
Item: Item 4
Chunk 232
---
 of such audits to the Energy Commission.

Regulations on Cyber Security

The Cyber Security Act 2024, or CSA, came into force on August 26, 2024 to establish the security measures to strengthen Malaysia’s cyber security resilience, particularly in relation to national critical information infrastructures (NCII). If we are designated as a NCII entity pursuant to the CSA, we will be required to comply with the requirements under the CSA, including to implement certain cyber security standards, processes and measures, conduct cyber security risk assessments and audits, and report to the applicable regulator and sector lead in the event of a cyber security incident.

The CSA establishes the overarching framework governing cyber security in Malaysia which shall be read together with its subsidiary legislations and existing laws relating to cyber security in Malaysia in separate pieces of legislation as described below.

The Personal Data Protection Act 2010, or PDPA, is the main legislation governing the processing of personal data in Malaysia. If we obtain a license under the CMA, we will then proceed to register as a data controller under the PDPA, pursuant to the Personal Data Protection (Class of Data Users) Order 2013 which provides that a data controller which belongs to any of the classes of data controllers (one of which includes being a licensee under the CMA), is required to obtain a certificate of registration under the PDPA. There is no absolute prohibition against cross-border transfers of personal data, so long as the transfer falls within one of the conditions permitting the transfer of personal data outside Malaysia as prescribed under the PDPA, which includes where the data subject has consented to the transfer of personal data outside Malaysia. Effective June 1, 2025, we will be required to appoint a data protection officer to oversee compliance with the data protection laws and serve as the primary contact point with the Personal Data Protection Commissioner and data subjects under the PDPA, if we meet the criteria stipulated under the Personal Data Protection Guideline: Data Protection Officer. For instance, this appointment obligation will apply where we process personal data of more than 20,000 data subjects, or if we process sensitive personal data or financial information of more than 10,000 data subjects. TheData Sharing Act 2025, DSA, regulates the sharing and handling of data controlled by a public sector agency. Where we are engaged by a public sector agency to conduct any data migration, data integration or data analytics work using shared data regulated under the DSA, we will be required to comply with the security requirements imposed by the DSA