Company: SOS
Filing Date: 2025-07-02
Form Type: S-8
Source: 0001213900-25-061032
Chunk: 36

Company: SOS Ltd
Filing Date: 2025-07-02
Form: S-8
Chunk 36
---
.
The Personal Information Protection Law clarifies the scope of application, the definition of personal information and sensitive personal
information, the legal basis of personal information processing and the basic requirements of notice and consent.

On October 29, 2021,
the CAC publicly solicited opinions on the Measures for the Security Assessment of Data Cross-border Transfer (Draft for Comments), which
requires that any data processor who provides to an overseas recipient important data collected and generated during operations within
the territory of the PRC or personal information that should be subject to security assessment shall conduct security assessment. The
Measures for the Security Assessment of Data Cross-border Transfer was adopted on July 7, 2022 and will take effect on September 1, 2022.

On November 14, 2021,
the CAC publicly solicited opinions on the Administrative Measures for Internet Data Security (Draft for Comments) (the “Draft Measures
for Internet Data Security”), which requires that data processors processing “important data” or listed overseas shall
conduct an annual data security assessment by itself or commission a data security service provider to do so and submit the assessment
report for the preceding year to the municipal cybersecurity department by the end of January each year. As of the date of this prospectus,
the Draft Measures for Internet Data Security has not been formally adopted. However, if the Draft Measures for Internet Data Security
were to be enacted in the current form, we, as an overseas listed company, will be required to conduct an annual data security review
and comply with the relevant reporting obligations. Furthermore, according to the Draft Measures for Internet Data Security, data processors
shall, in accordance with relevant state provisions, apply for cyber security review when carrying out the following activities: (1) the
merger, reorganization or separation of internet platform operators that have acquired a large number of data resources related to national
security, economic development or public interests, which affects or may affect national security, (2) data processors that handle the
personal information of more than one million people intends to be listed abroad, (3) the data processor intends to be listed in Hong
Kong, which affects or may affect national security, and (4) other data processing activities that affect or may affect national security.
It remains uncertain whether the requirement of cybersecurity review applies to follow-on offerings by an overseas-listed online platform
operator that possesses personal data of more than one million users. We completed our initial public offering on November 23, 2018, and