Company: CNTB
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001835268-25-000014
Chunk: 202

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 202
---
 our securities thereon. The CAC, however, has the discretion to initiate cybersecurity review on data processing activities which are deemed to affect or may affect national security. Thus, we cannot preclude the possibility that we would be subject to ex officio cybersecurity reviews by the CAC, and it is uncertain whether being listed in the U.S. would increase such possibility. If we are subject to such cybersecurity review, we may be ordered to suspend business or discontinue the development of new Product Candidates or business partnerships, among other things, pending completion of the review. If we fail to pass the cybersecurity review, we may face penalties such as fines, suspension of business, closure of websites, or revocation of relevant business licenses and permits, any of which could have a material adverse effect on our business and results of operations.

On July 7, 2022, the CAC promulgated the Security Assessment Measures for Outbound Data Transfer (the “Security Assessment Measures”) which came into effect on September 1, 2022. Pursuant to the Security Assessment Measures, a data processor shall apply to competent authorities for security assessment prior to transferring any data outside of the PRC if the transfer involves (i) important data; (ii) personal information transferred outside the PRC by a CIIO and a data processor that processes personal information of more than one million individuals; (iii) personal information transferred by a data processor outside the PRC who has already provided personal information of 100,000 persons or sensitive personal information of 10,000 persons outside the PRC since January 1 of the previous year; or (iv) other circumstances as requested by the CAC.

On March 22, 2024, the CAC promulgated the Provisions on Promoting and Regulating Cross-border Data Transfer, which narrow the scope of conditions that shall apply for a security assessment. Pursuant to the Provisions on Promoting and Regulating Cross-border Data Transfer, any data processor which exports personal information shall apply for a security assessment before transferring any personal information abroad if it satisfies any of the following conditions: (1) personal information and important data will be provided overseas by any operator of critical information infrastructure; (2) important data will be provided overseas by any data processor other than an operator of critical information infrastructure, or personal information of more than 1,000,000 individuals in aggregate (excluding sensitive personal information) or sensitive personal information of more than 10,000 individuals in aggregate has been provided overseas since January 1