Company: CNTB
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001835268-25-000014
Chunk: 203

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 203
---
 of the current year. If personal information of more than 100,000 individuals but less than 1,000,000 individuals in aggregate (excluding sensitive personal information) or sensitive personal information of less than 10,000 individuals in aggregate has been provided overseas by any data processor other than an operator of critical information infrastructure since January 1 of the current year, standard contracts for personal information transfer shall be entered into with the overseas receivers or the certification of personal information protection shall be passed in accordance with the law. Despite the above, where a data processor transfers data abroad, it may be exempted from applying for a cross-border transfer security assessment, 

84

concluding a standard contract for personal information to be provided abroad or passing a security certificate for personal information protection if it satisfies any of the following conditions: (1) where it is really necessary to provide personal information abroad for the purpose of concluding or performing a contract to which an individual concerned is a party, such as cross-border shopping, cross-border delivery, cross-border remittance, cross-border payment, cross-border account opening, air ticket and hotel reservation, visa handling and examination services; (2) where it is really necessary to provide employees’ personal information abroad for the purpose of conducting cross-border human resources management in accordance with the employment rules and regulations and collective contracts formulated in accordance with the law; (3) where it is really necessary to provide personal information abroad in an emergency to protect the life, health and property safety of a natural person; or (4) where a data processor other than a critical information infrastructure operator provides abroad the personal information (excluding sensitive personal information) of not more than 100,000 persons accumulatively as of January 1 of the current year. As of the date of this annual report, we have not processed more than 1,000,000 persons’ personal information or 10,000 persons’ sensitive personal information outside the PRC since January 1, 2024. In addition, as of the date of this Annual Report on Form 10-K, we have not been informed by any PRC government agency that we qualify as a CIIO, and the Information Security Technology-Guidance for Identifying Important Data are only drafts for comments and have not been officially adopted.

Also, the Standing Committee of the National People’s Congress released the Personal Information Protection Law, which became effective on November 1, 2021. The Personal Information Protection Law provides a comprehensive set of data privacy and protection requirements that apply to the processing of personal