Company: DDC
Filing Date: 2025-01-28
Form Type: 20-F
Source: 0001213900-25-007160
Chunk: 12

Company: DDC Enterprise Ltd
Filing Date: 2025-01-28
Form: 20-F
Item: Item 3
Chunk 12
---
 that we will adequately protect their personal information.
We are required by applicable laws to keep strictly confidential the personal information that we collect, and to take adequate security
measures to safeguard such information.

The PRC Criminal Law, as amended
by its Amendment 7 (effective on February 28, 2009) and Amendment 9 (effective on November 1, 2015), prohibits any person
from selling or providing a citizen’s personal information obtained during the course of performing duties or providing services,
or obtaining such information through theft or other illegal ways. On November 7, 2016, the SCNPC issued the Cyber Security Law of
the PRC, or the Cyber Security Law, which became effective on June 1, 2017. Pursuant to the Cyber Security Law, network operators
must not, without users’ consent, collect their personal information, and may only collect users’ personal information necessary
to provide their services. Providers are also obliged to provide security maintenance for their products and services and shall comply
with provisions regarding the protection of personal information as stipulated under the relevant laws and regulations. The Civil Code
of the PRC (issued by the PRC National People’s Congress on May 28, 2020 and effective from January 1, 2021) provides
main legal basis for privacy and personal information infringement claims under the Chinese civil laws. PRC regulators, including the
Cyberspace Administration of China, MIIT, and the Ministry of Public Security have been increasingly focusing on regulation in the areas
of data security and data protection. The PRC regulatory requirements regarding cybersecurity are constantly evolving. For instance, various
regulatory bodies in China, including the Cyberspace Administration of China, the Ministry of Public Security and State Administration
for Market Regulation, or the SAMR, have enforced data privacy and protection laws and regulations with varying and evolving standards
and interpretations. On November 14, 2021, the Cyberspace Administration of China, or the CAC, issued the Draft Cyber Data Security
Regulations for public comments, pursuant to which, data processors carrying out the following activities must, in accordance with the
relevant national regulations, apply for a cybersecurity review: (i) the merger, reorganization or spin-off of internet platform
operators that possess a large number of data resources related to national security, economic development and public interests that affects
or may affect national security; (ii) listing in a foreign country of data processors that process the personal