Company: DDC
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001213900-25-043916
Chunk: 13

Company: DDC Enterprise Ltd
Filing Date: 2025-05-15
Form: 20-F
Item: Item 3
Chunk 13
---
 processing activities that affect or may affect national security. The scope of and threshold for determining what “affects
or may affect national security” is still subject to uncertainty and further elaboration by the CAC. On December 28, 2021,
the CAC, and 12 other relevant PRC government authorities published the amended Cybersecurity Review Measures, which came into effect
on February 15, 2022. The final Cybersecurity Review Measures provide that a “network platform operator” that possesses personal
information of more than one million users and seeks a listing in a foreign country must apply for a cybersecurity review. Further, the
relevant PRC governmental authorities may initiate a cybersecurity review against any company if they determine certain network products,
services or data processing activities of such company affect or may affect national security. Through the contractual arrangements with
Shanghai Weishi Information Technology Co., Ltd. (“ Weishi”), Shanghai DayDayCook Information Technology Co., Ltd. (“ DDC
Shanghai”) had collected and possessed personal information of more than one million users. After the contractual arrangements with
Weishi were terminated in April 2022, DDC Shanghai still have been possessing this amount of personal information which are stored in
mainland China. For purposes of the Cybersecurity Review Measures, we have applied for and completed the cybersecurity review with respect
to our proposed overseas listing pursuant to the Cybersecurity Review Measures.

As there remains significant
uncertainty in the interpretation and enforcement of relevant PRC cybersecurity laws and regulations, we cannot assure you that we would
not become subject to enhanced cybersecurity review or investigations launched by PRC regulators in the future. Any failure or delay in
the completion of the cybersecurity review procedures or any other non-compliance with the related laws and regulations may result in
rectification, fines or other penalties, including suspension of business, website closure, removal of our app from the relevant app stores,
and revocation of prerequisite licenses, as well as reputational damage or legal proceedings or actions against us, which may have material
adverse effect on our business, financial condition or results of operations.

On June 10, 2021, the
SCNPC promulgated the PRC Data Security Law, which took effect on September 1, 2021. The PRC Data Security Law imposes data security
and privacy obligations on entities and individuals carrying out data activities, and introduces a data classification and hierarchical
protection system based on the importance of data in economic and social development, as well as the