Company: FGI
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001628280-25-015656
Chunk: 90

Company: FGI Industries Ltd.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 90
---
pliance could result in penalties or other significant legal liabilities.

Pursuant to the PRC Cybersecurity Law, personal information and important data collected and generated by a critical information infrastructure operator in the course of its operations in China must be stored in China, and if a critical information infrastructure operator purchases internet products and services that affects or may affect national security, it should be subject to cybersecurity review by the CAC. The Revised Cybersecurity Review Measures, which took effect on February 15, 2022, require critical information infrastructure operators procuring network products and services and online platform operators carrying out data processing activities, which affect or may affect national security, to conduct a cybersecurity review pursuant to the provisions therein. We do not believe that our company constitutes a “critical information infrastructure operator” under the Cybersecurity Review Measures, however, the exact scope of “critical information infrastructure operators” under the current regulatory regime remains unclear, and the PRC government authorities may have wide discretion in the interpretation and enforcement of the applicable laws. Additionally, the PRC Data Security Law took effect on September 1, 2021 and requires data collection to be conducted in a legitimate and proper manner, and stipulates that, for the purpose of data protection, data processing activities must be conducted based on data classification and hierarchical protection system for data security.

We believe we are compliant with these regulations, to the extent they are applicable to us, and we do not believe our business will be materially affected by these measures. However, if we were selected for review, or one of our  suppliers 

19

was selected for review, we or such supplier may be required to suspend operations in China during such review. Cybersecurity review could also result in negative publicity with respect to our company or our suppliers and could divert managerial attention and financial resources. Furthermore, if we or one of our suppliers were found to be in violation of applicable laws and regulations in China during such review, we or such supplier could be subject to administrative penalties, such as warnings, fines, or service suspension.

Pursuant to the PRC Cybersecurity Law, which was promulgated by the Standing Committee of the National People’s Congress on November 7, 2016 and took effect on June 1, 2017, personal information and important data collected and generated by a critical information infrastructure operator in the course of its operations in China must be stored in China, and if a critical information infrastructure operator purchases internet products and services that affects or may affect national security, it should be subject to cybersecurity review by