Company: CNTB
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001835268-25-000014
Chunk: 205

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 205
---
, etc. which would be applied based on the severity of the violation. On March 22, 2024, the CAC promulgated Personal Information Export Standard Contract Filing Guidelines (Second Edition), which is to match the Provisions on Promoting and Regulating Cross-border Data Transfer promulgated on the same day. Personal Information Export Standard Contract Filing Guidelines (Second Edition) further clarify the applicable scope of, conditions to enter into and detailed filing requirements for standard contracts on cross-border transfer of personal information. In December 2023, the Implementing Guidelines for Contracts on Cross-border Flow of Personal Information in the Guangdong-Hong Kong-Macau Greater Bay Area (Mainland, Hong Kong) jointly formulated by the CAC and the Innovation, Technology and Industry Bureau of Hong Kong, provides that the personal information processors and recipients of the Guangdong-Hong Kong-Macau Greater Bay Area (“GBA”) may, in accordance with the requirements of the Implementing Guidelines, carry out the cross-border flow of personal information between the Mainland and Hong Kong within the GBA by entering into a standard contract, except for personal information notified by the relevant authorities or regions or publicly announced as important data.

85

On January 1, 2025, the Regulations on Network Data Security Management (“Regulations”) took effect in China. These Regulations have extraterritorial effect and apply broadly to any network data processing activities (not only personal information processing activities). The Regulations reiterate and expand on the existing obligations on data processors under the Cybersecurity Law, Data Security Law and the PIPL and introduce new network and data security obligations, such as a requirement to report any risks arising from network products and services that may endanger national security or public interest to the relevant authorities within 24 hours.

Interpretation, application and enforcement of these laws, rules and regulations evolve from time to time and their scope may continually change, through new legislation, amendments to existing legislation or changes in enforcement. Compliance with such laws, rules and regulations could significantly increase the cost of our operations, require significant changes to our operations or even prevent us from operating in jurisdictions in which we currently operate or in which we may operate in the future. Despite our efforts to comply with applicable laws, rules, regulations and other obligations relating to privacy, data protection and information security, it is possible our operations could fail to meet all of the requirements imposed on us. Any failure on our part to comply, or any compromise of security that results in unauthorized access, use or