Company: RSKD
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001851112-25-000006
Chunk: 85

Company: RISKIFIED LTD.
Filing Date: 2025-03-06
Form: 20-F
Item: Item 4
Chunk 85
---
 increase the regulatory burden on entities that are subject to this requirement. The PIPL became effective on November 1, 2021. Notably, the PIPL, similar to the GDPR, applies extra-territorially and reiterates the circumstances under which a personal information processor may process personal information, such as when (i) the individual’s consent has been obtained; (ii) the processing is necessary for the performance of a contract to which the individual is a party; (iii) the processing is necessary to fulfil statutory duties and statutory obligations; (iv) the processing is necessary to respond to public health emergencies or protect the life, health and property safety of natural persons under emergency circumstances; (v) the personal information that has been made public is processed within a reasonable scope in accordance with the PIPL; (vi) personal information is processed within a reasonable scope to conduct news reporting, public opinion-based supervision, and other activities in the public interest; or (vii) under any other circumstance as provided by any law or regulation. Failure to comply with PIPL can result in fines of up to RMB 50 million or 5% of the prior year’s total annual revenue for the personal information processor and/or a suspension of services or data processing activities. Other potential penalties include a fine of up to RMB 1 million on the person in charge or directly-responsible personnel and, in serious cases, individuals and entities may be exposed to criminal liabilities under other local Chinese law, such as the Criminal Law of the People’s Republic of China. The PIPL also prohibits personnel responsible for violations of the PIPL from holding high level management or data protection officer positions in relevant enterprises. The CSL, DSL and PIPL also impose certain data localization requirements on CIIOs, important data processors and organizations that process personal information above a certain threshold, unless an exemption applies. Furthermore, the national regulators, namely the Cybersecurity Administration of China and the State Administration of Market Regulation, have continued to issue new guidance and requirements for the processing of personal data. As the introduction of new compliance requirements that occur on an ongoing basis typically apply with immediate effect, they may lead to additional costs and may require further changes to our compliance operations. See Item 3. D. “ Risk Factors - Risks Related to our Business and Industry - Compliance with continuously evolving privacy laws and regulations, including laws and regulations governing processing of personal information, including payment card data, and our actual or perceived failure to comply with such laws and

regulations may result in