Company: XHG
Filing Date: 2025-10-29
Form Type: F-3/A
Source: 0001213900-25-103499
Chunk: 50

Company: XChange TEC.INC
Filing Date: 2025-10-29
Form: F-3/A
Chunk 50
---
 affect China’s national security. The amended Measures of Cybersecurity
Review took effect on February 15, 2022. In August 2021, the Standing Committee of the National People’s Congress of China promulgated
the Personal Information Protection Law which became effective on November 1, 2021. The Personal Information Protection Law provides a
comprehensive set of data privacy and protection requirements that apply to the processing of personal information and expands data protection
compliance obligations to cover the processing of personal information of persons by organizations and individuals in China, and the processing
of personal information of persons outside of China if such processing is for purposes of providing products and services to, or analyzing
and evaluating the behavior of, persons in China. The Personal Information Protection Law also provides that critical information infrastructure
operators and personal information processing entities who process personal information meeting a volume threshold to be set by Chinese
cyberspace regulators are also required to store in China the personal information generated or collected in China, and to pass a security
assessment administered by Chinese cyberspace regulators for any export of such personal information. Moreover, pursuant to the Personal
Information Protection Law, persons who seriously violate this law may be fined for up to RMB50 million or 5% of annual revenues generated
in the prior year and may also be ordered to suspend any related activity by competent authorities.

In November 2021, the CAC released the Regulations
on Network Data Security (draft for public comments) and accepted public comments until December 13, 2021. The draft Regulations on Network
Data Security provide more detailed guidance on how to implement the general legal requirements under laws such as the Cybersecurity Law,
Data Security Law and the Personal Information Protection Law. The draft Regulations on Network Data Security follow the principle that
the state will regulate based on a data classification and multi-level protection scheme, under which data is largely classified into
three categories: general data, important data and core data. Under the current PRC cybersecurity laws in China, critical information
infrastructure operators that intend to purchase internet products and services that may affect national security must be subject to the
cybersecurity review. On July 30, 2021, the State Council of the PRC promulgated the Regulations on the Protection of the Security of
Critical Information Infrastructure, which took effect on September 1, 2021. The regulations require, among others, that certain competent
authorities shall identify critical information infrastructures. If any critical information infrastructure is identified