Company: XCH
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056976
Chunk: 83

Company: XCHG Ltd
Filing Date: 2025-04-23
Form: 20-F
Item: Item 4
Chunk 83
---
 of over one million users shall be subject to cybersecurity review before listing abroad. The competent governmental authorities may also initiate a cybersecurity review against the operators if the authorities believe that the network product or service or data processing activities of such operators affect or may affect national security.
On July 30, 2021, the State Council promulgated the Regulations on Security Protection of Critical Information Infrastructures, which took effect on September 1, 2021 and provides that “critical information infrastructures” refer to any important network facilities or information systems of important industries or fields such as public communication and information service, energy, communications, water conservation, finance, public services, e-government affairs and national defense science, and any other important network facilities or information systems which may endanger national security, people’s livelihood and public interest in case of damage, function loss or data leakage.
In addition, the competent governmental authorities shall notify the operators if such operators are determined as critical information infrastructure operators. On June 10, 2021, the SCNPC promulgated the Data Security Law of the PRC, or the Data Security Law, with effect from September 1, 2021. The Data Security Law establishes a data classification and hierarchical protection system depending on the importance of the data in economic and social development, and the damage caused to national security, public interests, or the legitimate rights and interests of individuals and organizations if the data is falsified, damaged, disclosed, illegally obtained or illegally used.
On July 7, 2022, the CAC promulgated the Security Assessment Measures for Cross-border Data Transfers with effect from September 1, 2022, a data processor shall declare security assessment for its outbound data transfer if: (i) where a data processor provides critical data abroad; (ii) where a critical information infrastructure operator or a data processor processing the personal information of more than one million individuals provides personal information abroad; (iii) where a data processor has provided personal information of 100,000 individuals or sensitive personal information of 10,000 individuals in total abroad since January 1 of the previous year; and (iv) any other circumstances prescribed by the CAC. Any failure to comply with such requirements may subject to, among others, suspension of services, fines, revoking relevant business permits or business licenses and penalties. On February 22, 2023, the CAC promulgated the Measures on the Standard Contract for Cross-Border Transfer of Personal Information, which became effective on June 1, 202