Company: HMDCF
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001410578-25-000377
Chunk: 56

Company: HUTCHMED (China) Ltd
Filing Date: 2025-03-19
Form: 20-F
Item: Item 1
Chunk 56
---
 the PRC cybersecurity laws and regulations. In addition, on January 1, 2025, the Data Security Management Measures published by the State Council became effective. The Data Security Management Measures provide, among others, that data processors processing ‘important data’ should carry out risk assessments on their network data processing activities annually and submit risk assessment reports to the relevant competent departments at the provincial level or above. Important data is defined as data of specific fields, specific groups, specific regions, or of a certain level of precision and scale which, if tampered with, destroyed, leaked, illegally obtained, or misused, may directly endanger national security, the economy, social stability, and public health and safety. As there are still uncertainties regarding the enactment of new laws and regulations as well as the revision, interpretation and implementation of those existing laws and regulations, we cannot assure you that we will be able to comply with such regulations in all respects.

The Measures on Security Assessment of Cross-border Data Transfer (“ Security Assessment Measures”) were published on July 7, 2022, and became effective on September 1, 2022. The Security Assessment Measures specify that data controllers and/or critical information infrastructure operators will be subject to security assessment under the following circumstances: (i) data controllers exporting important data (which, under the Security Assessment Measures, is defined as data which if tampered with, damaged, leaked, or if obtained or used illegally may endanger national security, the economy, social stability, and public health and safety, etc.), (ii) critical information infrastructure operators or data controllers processing the personal information of one million people or more exporting personal information, (iii) data controllers who have exported the personal information of 100,000 people or the sensitive personal information of 10,000 people since January 1 of the previous year, or (iv) other situations provided for by the CAC that require a security assessment. As of the date of this annual report, we have not received any formal notice from any PRC cybersecurity regulator that the Company should apply for or otherwise be subject to security assessment, or subject to any investigation or received any inquiry, notice or sanction on security assessment. PRC government authorities may have wide discretion in the interpretation and enforcement of the Security Assessment Measures, including whether we have exported “important data” as defined thereunder, and thus there is uncertainty as to whether we may be subject to security assessment. Further, drafts of some of these measures have now been published, including the Measures on Security Assessment for Individual Information Cross-border