Company: GDHLF
Filing Date: 2025-05-29
Form Type: 424B5
Source: 0001104659-25-053912
Chunk: 58

Company: GDS Holdings Ltd
Filing Date: 2025-05-29
Form: 424B5
Chunk 58
---
 intended to be clarified through a series of laws, implementing regulations and guidelines to be issued by relevant authorities. Numerous regulations, guidelines and other measures have been and are expected to be adopted under the Cybersecurity Law. For more details, see “Item 4. Information on the Company — B. Business Overview — Regulatory Matters Related to Our Business — People’s Republic of China Regulations — Regulations Related to Information Security and

<div align='center'>S-24</div>

TABLE OF CONTENTS

Confidentiality of User Information” in our 2024 Annual Report. Currently, the Cybersecurity Law and relevant regulations, guidelines and other measures have not directly impacted our operations, but in light of rapid advances in its implementation, we believe the implementation of the Cybersecurity Law involves potential risks to our business because we may be deemed as the network operator of critical information infrastructure thereunder.

Furthermore, the PRC regulatory and enforcement regime with regard to data security and data protection has continued to evolve. There are uncertainties on how certain laws and regulations will be implemented in practice. PRC regulators have been increasingly focused on regulating data security and data protection. We expect that these areas will receive greater attention from regulators, as well as attract public scrutiny and attention going forward. This greater attention, scrutiny and enforcement, including more frequent inspections, could increase our compliance costs and subject us to heightened risks and challenges associated with data security and protection. As of the date of this prospectus supplement, we have not been designated as operator of critical information infrastructure by the PRC governmental authorities. While we do not have access to our customers’ data stored on the servers collocated in our data centers, we cannot rule out the possibility that data related to our operations may be deemed important data/core data or we may be deemed to be a critical information infrastructure operator, which would subject us to additional supervisory requirements. Any incompliance on such additional supervisory requirements may subject us to fines, order to rectify, suspension of users registration, revocation of business certificate and other penalties, which may have material adverse effect on our business, operations and financial condition as well as the price of our securities.

In addition, we could become subject to enhanced cybersecurity review or investigations launched by PRC regulators in the future. The Data Security Law provides that the state shall establish a data security review mechanism on data processing activities that do or may affect national security. Pursuant to the Cybersecurity Review Measures effective on February 15, 2022, critical information infrastructure operators that procure internet products and services must be