Company: SOS
Filing Date: 2025-06-25
Form Type: F-3/A
Source: 0001213900-25-057886
Chunk: 50

Company: SOS Ltd
Filing Date: 2025-06-25
Form: F-3/A
Chunk 50
---
 results in the unauthorized access
to, or acquisition, release or transfer of, personally identifiable information or other data relating to customers or individuals may
result in governmental investigations, inquiries, enforcement actions and prosecutions, private claims and litigation, fines and penalties,
adverse publicity or potential loss of business. For example, on June 10, 2021, the Standing Committee of the National People’s
Congress (the “Standing Committee of the NPC”), promulgated the PRC Data Security Law, which took effect in September 2021.
The PRC Data Security Law provides for data security obligations on entities and individuals carrying out data activities. The PRC Data
Security Law also introduces a national security review procedure for those data activities which may affect national security and imposes
export restrictions on certain data information. Furthermore, along with the promulgation of the Opinions on Strictly Cracking Down Illegal
Securities Activities in accordance with the Law, overseas-listed China-based companies are experiencing a heightened scrutiny over their
compliance with laws and regulations regarding data security, cross-border data flow and management of confidential information from PRC
regulatory authorities.

<div align='center'>25</div>

On August 20, 2021, the Standing Committee
of the NPC issued the Personal Information Protection Law, which has been effective from November 1, 2021 and reiterates the circumstances
under which a personal information processor could process personal information and the requirements for such circumstances. The Personal
Information Protection Law clarifies the scope of application, the definition of personal information and sensitive personal information,
the legal basis of personal information processing and the basic requirements of notice and consent.

On October 29, 2021, the CAC publicly solicited
opinions on the Measures for the Security Assessment of Data Cross-border Transfer (Draft for Comments), which requires that any data
processor who provides to an overseas recipient important data collected and generated during operations within the territory of the PRC
or personal information that should be subject to security assessment shall conduct security assessment. The Measures for the Security
Assessment of Data Cross-border Transfer was adopted on July 7, 2022 and will take effect on September 1, 2022.

On November 14, 2021, the CAC publicly solicited
opinions on the Administrative Measures for Internet Data Security (Draft for Comments) (the “Draft Measures for Internet Data Security”),
which requires that data processors processing “important data” or listed overseas shall conduct an annual