Company: KPEA
Filing Date: 2025-01-14
Form Type: 10-K
Source: 0001493152-25-002124
Chunk: 465

Company: Kun Peng International Ltd.
Filing Date: 2025-01-14
Form: 10-K
Item: Item 1
Chunk 465
---
7, created China’s first national-level data protection regime for “network operators,”
which may include all organizations in China that provide services over the internet or another information network. It provides that
personal information and important data collected and generated by operators of critical information infrastructure in the course of
their operations in the PRC should be stored in the PRC, and the law imposes heightened regulation and additional security obligations
on operators of critical information infrastructure. It also provides that network operators are required to implement security protection
measures to ensure that the network is free from interference, disruption, or unauthorized access, and to prevent network data from being
disclosed, stolen, or tampered.

Data
Security Law. On June 10, 2021, the Standing Committee of the National People’s Congress of China promulgated the Data Security
Law which took effect on September 1, 2021.

The
Data Security Law establishes a tiered system for data protection in terms of importance, in which data categorized as “important
data,” which will be determined by governmental authorities in the form of catalogs, are required to be treated with a higher level
of protection. Specifically, the Data Security Law provides that operators processing “important data” are required to appoint
a “data security officer” and a “management department” to take charge of data security. In addition, such operator
is required to evaluate the risk of its data activities periodically and file assessment reports with relevant regulatory authorities.
In addition, the Data Security Law prohibits entities and individuals in China from providing any foreign judicial or law enforcement
authority with any data stored in China without approval from competent PRC authority, and sets forth the legal liabilities of entities
and individuals found to be in violation of their data protection obligations, including rectification order, warning, fines of up to
RMB10 million, suspension of relevant business, and revocation of business permits or licenses.

There
can be no assurance that we would be able to complete the applicable cybersecurity review procedures in a timely manner, or at all, if
we are required to follow such procedures. This could have a material adverse effect on our results of operations and business prospects.
Moreover, the notion of “important data” is not clearly defined by the Cybersecurity Law or the Data Security Law. In order
to comply with the statutory requirements, we will need to determine whether we possess important data, monitor the important data catalogs
that are expected to be published by local governments and departments, perform risk assessments, and