Company: VSA
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001410578-25-001300
Chunk: 138

Company: VisionSys AI Inc
Filing Date: 2025-05-15
Form: 20-F
Item: Item 4
Chunk 138
---
 China without the approval of the competent PRC authorities.

78

On August 17, 2021, the State Council promulgated the Regulations on the Security Protection of Critical Information Infrastructure, which came into effect on September 1, 2021. The regulations provides that, among others, critical information infrastructure means key network facilities or information systems of critical industries or sectors, such as public communication and information service, energy, transportation, water conservation, finance, public services, e-government affairs and national defense science, the damage, malfunction or data leakage of which may endanger national security, people’s livelihoods and the public interest. Operators shall, based on leveled system for cybersecurity protection, adopt technical protection measures and other necessary measures to deal with cybersecurity security events, defend against cyber-attack and criminal activities, ensure the safe and stable operation of critical information infrastructure, and maintain the data integrity, confidentiality and availability pursuant to the laws, regulations and mandatory requirements of national standards. The governmental authorities of each critical industry and sector shall be responsible for formulating eligibility criteria and determining the scope of critical information infrastructure operator in the respective industry or sector and operators will be informed about the final determination as to whether they are categorized as critical information infrastructure operators.
On August 20, 2021, the Standing Committee of the National People’s Congress promulgated the Personal Information Protection Law, which took effect on November 1, 2021. The Personal Information Protection Law aims at protecting the personal information rights and interests, regulating the processing of personal information, ensuring the orderly and free flow of personal information in accordance with the law, and promoting the reasonable use of personal information. According to the Personal Information Protection Law, personal information includes all kinds of identified or identifiable information related to natural persons recorded by electronic or other means, but excludes de-identified information. The Personal Information Protection Law also specifies the rules for handling sensitive personal information, which includes biometrics, religious beliefs, specific identities, medical health, financial accounts, trails and locations, and personal information of teenagers under fourteen years old and other personal information, which, upon leakage or illegal usage, may easily infringe the personal dignity or harm of safety of livelihood and property. Personal information handlers shall bear the responsibility for their personal information handling activities, and adopt necessary measures to safeguard the security of the personal information they handle. Otherwise, the personal information handlers will be ordered for rectification or suspension or termination of provision of services, confiscation of illegal income, subject to fines or other penalties.
Network Data Regulations were promulg