Company: XHG
Filing Date: 2025-01-22
Form Type: 20-F
Source: 0001213900-25-005499
Chunk: 29

Company: XChange TEC.INC
Filing Date: 2025-01-22
Form: 20-F
Item: Item 3
Chunk 29
---
 of the
PRC. On August 20, 2021, the Standing Committee of the National People’s Congress (the “ SCNPC”) promulgated the Personal
Information Protection Law of the PRC (the “ PIPL”), which took effect on November 1, 2021. The PIPL further emphasizes processors’
obligations and responsibilities for personal information protection and sets out the basic rules for processing personal information
and the rules for cross-border transfer of personal information.

Regulatory requirements on cybersecurity and
data privacy are constantly evolving and can be subject to significant changes, which may result in uncertainties regarding the scope
of our relevant responsibilities. For example, The Regulations on the Administration of Cyber Data Security (Draft for Comments) (the
“ Draft Cyber Data Security Regulations”) was released by CAC on November 14, 2021. According to the Draft Cyber Data Security
Regulations, data processors seeking a public listing in overseas that affect or may affect national security are required to apply for
cybersecurity review. The scope of and threshold for determining what “affects or may affect national security” is still
subject to uncertainty and further elaboration by the CAC. On January 4, 2022, together with 12 other Chinese regulatory authorities,
the CAC released the Revised CAC Measures, which came into effect on February 15, 2022. Pursuant to the Revised CAC Measures, critical
information infrastructure operators (the “ CIIOs”) procuring network products and services, and online platform operators
carrying out data processing activities which affect or may affect national security, shall conduct a cybersecurity review pursuant to
the provisions therein. In addition, online platform operators possessing personal information of more than one million users seeking
to be listed on foreign stock markets must apply for a cybersecurity review. On July 7, 2022, the CAC promulgated the Measures for the
Security Assessment of Cross-Border Transfer of Data, which took effect on September 1, 2022. These measures aim to regulate cross-border
transfers of data, requiring among other things, that data processors that provide data overseas apply to CAC for security assessments
if: (1) data processors provide important data overseas; (2) critical information infrastructure operators or data processors process
personal information of more than one million individuals provide personal information to overseas parties; (3) data processors that
have cumulatively provided personal information of 100,000 people or sensitive personal