Company: ABTS
Filing Date: 2025-12-02
Form Type: F-3/A
Source: 0001493152-25-025631
Chunk: 45

Company: Abits Group Inc
Filing Date: 2025-12-02
Form: F-3/A
Chunk 45
---
 cybersecurity review is required where critical information infrastructure operators, or the “CIIOs,” purchase network-related products and services, which products and services affect or may affect national security. On December 28, 2021, the Cybersecurity Review Measures (2021 Version) was promulgated and became effective on February 15, 2022 and the Cybersecurity Review Measures (2020 Version) was repealed at the same time. The Cybersecurity Review Measures (2021 Version) iterates that the procurement of any network product or service by CIIOs or the conducting of data processing activities by online platform operators, that affects or may affect national security, shall be subject to a cybersecurity review and any online platform operators controlling personal information of more than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review.

On June 10, 2021, the Standing Committee of the National People’s Congress promulgated the Data Security Law which took effect on September 1, 2021. The Data Security Law requires that data shall not be collected by theft or other illegal means, and it also provides that a data classification and hierarchical protection system. The data classification and hierarchical protection system protects data according to its importance in economic and social development, and the damages it may cause to national security, public interests, or the legitimate rights and interests of individuals and organizations if the data is falsified, damaged, disclosed, illegally obtained or illegally used, which protection system is expected to be built by the state for data security in the near future. On November 14, 2021, the CAC published the Network Data Security Administrative Regulations Draft, which provided that data processing operators engaging in data processing activities that affect or may affect national security or processing personal information of more than one million users must be subject to a cybersecurity review. The official version of the regulation, or the Regulation for the Administration of Network Data Security (the “Network Data Security Regulation”), which was promulgated on September 24, 2024 and came into effect on January 1, 2025, does not contain a requirement for an application of cybersecurity review for data processing operators who possess personal data of at least one million users. Instead, it requires that a network data processor who carries out network data processing activities that affect or may affect national security shall undergo a national security review in accordance with relevant national regulations.

According to the Cybersecurity Review Measures (2021 Version) and the Network Data Security Regulation, a cybersecurity review is conducted by the