Company: VSA
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001410578-25-001300
Chunk: 141

Company: VisionSys AI Inc
Filing Date: 2025-05-15
Form: 20-F
Item: Item 4
Chunk 141
---
 within the territory of China, allowing inquiry, retrieval, download and export by overseas agencies, organizations or individuals; and (iii) other data handling activities such as handling of the personal information of domestic natural persons abroad under the circumstances specified in Paragraph 2 of Article 3 of the Personal Information Protection Law.
On 12 February 2025, the CAC promulgated the Administrative Measures for Personal Information Protection Compliance Audits, or the Audits Administrative Measures, which will become effective on May 1, 2025. The Audits Administrative Measures provided that any personal information handler handling the personal information of more than 10 million people shall carry out the personal information protection compliance audits at least once every two years. For a personal information handler who falls under any of the following circumstances, the cyberspace administration of China and other authorities performing responsibilities of personal information protection (hereinafter collectively referred to as the “protection authorities” in short) may require the personal information handler to entrust a specialized agency with the compliance audit of its personal information handling activities: (i) Where its personal information handling activities involve relatively large risks such as serious impact on personal rights and interests or serious lack of security measures; (ii) Where its personal information handling activities may infringe upon the rights and interests of many people; or (iii) Where a personal information security incident occurs, resulting in the divulgence, tampering with, loss or damage of the personal information of more than one million people or the sensitive personal information of more than 100,000 people. For the same personal information security incident or risk, it is not allowed to repeatedly require the personal information handler concerned to entrust a specialized agency with the personal information protection compliance audits.

80

While we take measures to comply with all applicable data privacy and protection laws and regulations, we cannot guarantee the effectiveness of the measures undertaken by us and business partners. As certain laws and regulations, including the PRC Data Security Law and the PRC Personal Information Protection Law, were recently promulgated, we may be required to make further adjustments to our business practices to comply with these laws and regulations. See “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business—Our business is subject to complex and evolving Chinese laws and regulations regarding cybersecurity, information security, privacy and data protection. Many of these laws and regulations are subject to change and uncertain interpretation, and any failure or perceived failure to comply with these laws and regulations could result in claims, changes to our business practices