Company: KPEA
Filing Date: 2025-01-14
Form Type: 10-K
Source: 0001493152-25-002124
Chunk: 466

Company: Kun Peng International Ltd.
Filing Date: 2025-01-14
Form: 10-K
Item: Item 1
Chunk 466
---
 ensure that we are complying with
reporting obligations to applicable regulators, if necessary. Furthermore, if judicial and law enforcement authorities outside China
require us to provide data stored in China, and we are not able to pass any required government security review or obtain any required
government approval to do so, we may not be able to meet the foreign authorities’ requirements. The potential conflicts in legal
obligations could have an adverse impact on our operations in and outside China.

Cybersecurity
Review Measures. In January 2022, the CAC and several other administrations jointly promulgated the amended Cybersecurity Review
Measures, or the Cybersecurity Review Measures, which became effective on February 15, 2022, and which supersede and replace the cybersecurity
review measures that became effective in June 2020. Pursuant to the Cybersecurity Review Measures, a “critical information infrastructure
operator,” or a CIIO, that purchases network products and services or conducts data processing activities that affect or may affect
national security will be subject to cybersecurity review. The Cybersecurity Review Measures also expands the cybersecurity review to
“internet platform operators” in possession of personal information of over one million users if such operators intend to
list their securities in a foreign country. Alternatively, relevant governmental authorities in the PRC may initiate cybersecurity review
if they determine an operator’s network products or services or data processing activities affect or may affect national security.
We do not believe that our Company constitutes a critical information infrastructure operator and we have less than one million registered
users on our digital platform.

On
November 14, 2021, the Cyberspace Administration of China released the Regulations on Network Data Security (draft for public comments), the final version of which went into effect on January 1, 2025.
The Regulations on Network Data Security provide that data processors refer to individuals or organizations that autonomously determine
the purpose and the manner of processing data. If a data processor that processes personal data of more than one million users intends
to list overseas, it shall apply for a cybersecurity review. In addition, data processors that process important data or are listed overseas
shall carry out an annual data security assessment on their own or by engaging a data security services institution, and the data security
assessment report for the prior year should be submitted to the local cyberspace affairs administration department before January 31
of each year.

41

Under
the Data Security Law and the Cybersecurity Review Measures, as long as we are not deemed to