Company: EZOO
Filing Date: 2025-05-15
Form Type: 10-K
Source: 0001641172-25-010460
Chunk: 477

Company: Ezagoo Ltd
Filing Date: 2025-05-15
Form: 10-K
Item: Item 1
Chunk 477
---
 shall notify the operator of the critical information infrastructure in time after the identification
of certain critical information infrastructure.

On
August 20, 2021, the SCNPC adopted the Personal Information Security Law, which took effect on November 1, 2021. The Personal Information
Protection Law includes the basic rules for personal information processing, the rules for cross-border provision of personal information,
the rights of individuals in personal information processing activities, the obligations of personal information processors, and the
legal responsibilities for illegal collection, processing, and use of personal information. As the first systematic and comprehensive
law specifically for the protection of personal information in the PRC, the Personal Information Protection Law provides, among others,
that (i) an individual’s consent shall be obtained to use sensitive personal information, such as biometric characteristics and
individual location tracking, (ii) personal information operators using sensitive personal information shall notify individuals of the
necessity of such use and impact on the individual’s rights, and (iii) where personal information operators reject an individual’s
request to exercise his or her rights, the individual may file a lawsuit with a People’s Court.

On
December 28, 2021, the CAC, NDRC, and other regulatory agencies jointly issued the final version of the Revised Cybersecurity Review
Measures, or the Measures, which took effect and replace the previously issued Revised Measures for Cybersecurity Review on February
15, 2022. Under the Revised Review Measures, an “online platform operator” in possession of personal data of more than one
million users must apply for a cybersecurity review if it intends to list its securities on a foreign stock exchange. The operators of
critical information infrastructure purchasing network products and services, and the online platform operators (together with the operators
of critical information infrastructure, the “Operators”) carrying out data processing activities that affect or may affect
national security, shall conduct a cybersecurity review, and any online platform operator who controls more than one million users’
personal information must go through a cybersecurity review by the cybersecurity review office if it seeks to be listed in a foreign
country.

With
regard to the current effective data security management regulations, we don’t believe that we are required to conduct data security
review for listing overseas. However, according to the Regulations on Network Data Security Management (Draft for Comment), as an overseas
listed company, we will be required to conduct an annual data security review and to comply with the relevant reporting obligations.
We have been closely monitoring the