Company: VSA
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001410578-25-001300
Chunk: 140

Company: VisionSys AI Inc
Filing Date: 2025-05-15
Form: 20-F
Item: Item 4
Chunk 140
---
 processor processing personal information of more than 1 million individuals, transfers personal information overseas; (iii) a data processor who has, since January 1 of the previous year, transferred personal information of more than 100,000 individuals overseas cumulatively, or transferred sensitive personal information of more than 10,000 individuals overseas cumulatively; or (iv) other circumstances under which security assessment of data cross-border transfer is required as prescribed by the national cyberspace administration.
On March 22, 2024, the Cyberspace Administration of China issued Regulations on Promoting and Regulating Cross-Border Data Flows, or the Cross-border Data Flows Regulations, outlining the mechanisms that have to be used for the transfer of data to other jurisdictions. The Cross-border Data Flows Regulations further specifies the threshold for conducting security assessments and filing standard contracts for outbound data transfer. Under the Cross-border Data Flows Regulations, entities don’t have to apply data export security assessments to transfer data if relevant departments have not notified them, the important data was made public, the data was collected through activities such as international trade, cross-border transportation, and do not contain personal information or important data, or if the data is transferred to China only for processing purposes. Furthermore, entities are transferring data for the purposes of performing a contract, human resources management, or emergencies or are sending personal information of less than 100,000 individuals and do not include important data or sensitive personal information are exempted from applying for a data export security assessment, entering into a standard contract for the export of personal information, and passing personal information protection certification. The entities transferring important data overseas, providing personal information of more than 1 million people or providing sensitive personal information of more than 10,000 people will have to apply for data export security assessment and obtain approval. Finally, the entities will be able to enter into a standard contract or pass certification for personal information transfer abroad if they are transferring data to more than 100,000 people but less than 1 million people, excluding sensitive personal information, since 1 January of that year.
Furthermore, on March 22, 2024, the CAC promulgated the Guide to Applications for Security Assessment of Outbound Data Transfers (Second Edition), which provides that any of the following circumstances is deemed as the act of outbound data transfers: (i) a data processor transfers abroad the data collected and generated from its operation within the territory of China; (ii) the data collected and generated by the data processor is stored