Company: GDHLF
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001410578-25-000935
Chunk: 390

Company: GDS Holdings Ltd
Filing Date: 2025-04-28
Form: 20-F
Item: Item 16K
Chunk 390
---
ITEM 16K. CYBERSECURITY

Cybersecurity Risk Management and Strategy

We have adopted a risk management and internal control system to manage the various risks that we face. Cybersecurity risk management is an important component of our overall risk management framework. We have
designed and implemented
a process for categorizing, classifying and handling cybersecurity incidents to enhance our cybersecurity risk management.

We have established an information security working mechanism, which is responsible for cybersecurity risk management, including information security, data security, privacy protection and supply chain cybersecurity risks, the assessment and management of significant risks posed by cybersecurity threats, as well as the prevention, monitoring, response and remediation of cybersecurity incidents. We have an independent information security team in our Information Technology Department that is dedicated to managing cybersecurity and data security risks. We have also engagedthird-partyservice providers to conduct independent cybersecurity audits and assessments periodically and on an ad hoc basis.

We have established management systems such as an information security management system, a privacy information management system and a business continuity system. We have also established a data security management system covering the full life cycle of data to effectively improve our data security risk management posture.

We have implemented various technical measures to timely identify and address cybersecurity threats. We have also established a Cybersecurity Operations Center and a team of professionals to monitor, analyze and mitigate potential cyber threats.

Although we believe we have a robust program to protect against cybersecurity risks, we maynotbe able to prevent a cybersecurity incident that could have a material adverse effect on us. See “ Item 3. Key Information - D. Risk Factors” for further discussion of cybersecurity risks.

Table of Contents

Cybersecurity Governance

Our board of directors has delegated to ouraudit committeethe responsibility for participating in and overseeing our efforts to monitor, assess and manage risks associated with cybersecurity threats or incidents. Our audit committee is responsible for receiving reports from management on any significant cybersecurity risks and incidents and for discussing improvement plans with management. In addition, our audit committee is responsible for receiving regular reports from management on cybersecurity risk governance, management and strategy and for discussing these with our internal audit team and our
third-party service providers
to fulfil the committee’s function of overseeing cybersecurity risks.

Our management understands andoverseesthe prevention, monitoring, response and remediation of cybersecurity risks and incidents, make decisions on matters related to cybersecurity risks, approve policies and procedures, and conduct regular cybersecurity risk meetings.

Our management meets regularly to be briefed on cybersecurity risk work and to
report
on such work to our audit