Company: VSA
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001410578-25-001300
Chunk: 35

Company: VisionSys AI Inc
Filing Date: 2025-05-15
Form: 20-F
Item: Item 3
Chunk 35
---
 whether we would be deemed to be a critical information infrastructure operator under laws of mainland China. If we are deemed to be a critical information infrastructure operator under the cybersecurity laws and regulations of mainland China, we may be subject to obligations in addition to what we have fulfilled under the cybersecurity laws and regulations of mainland China, and we may be subject to cybersecurity review when purchasing internet products and services or engaging in data processing activities.
Network Data Regulations were promulgated by the State Council on September 24, 2024, and became effective as of January 1, 2025. The Network Data Regulations restates and further specifies the legal requirements for personal information, important data, cross-border data transfer, network platform services, and data security. Among others, network data handlers engaging in data processing activities that affect or may affect national security must be subject to network data security review by the relevant cyberspace administration of the PRC. Any failure to comply with such requirements may subject us to, among others, suspension of services, fines, revoking relevant business permits or business licenses and penalties.
Personal Information and Privacy
The Civil Code promulgated in 2020 provides specific provisions regarding the protection of personal information. The Anti-monopoly Guidelines for the Platform Economy Sector published by the Anti-monopoly Committee of the State Council, effective on February 7, 2021, prohibits collection of user information through coercive means by online platforms operators.
In August 2021, the Standing Committee of the National People’s Congress promulgated the Personal Information Protection Law, which integrates the scattered rules with respect to personal information rights and privacy protection and took effect on November 1, 2021. We update our privacy policies from time to time to meet the latest regulatory requirements of PRC government authorities and adopt technical measures to protect data and ensure cybersecurity in a systematic way. Nonetheless, the Personal Information Protection Law elevates the protection requirements for personal information processing, and many specific requirements of this law remain to be clarified by the Cyberspace Administration of China, other regulatory authorities, and courts in practice. We may be required to make further adjustments to our business practices to comply with the personal information protection laws and regulations.
On July 7, 2022, the CAC promulgated the Security Assessment Measures which took effect on September 1, 2022. Pursuant to the Security Assessment Measures, a data processor shall apply to competent authorities for security assessment prior to transferring any data abroad if the transfer involves (i) important data; (ii)