Company: RSKD
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001851112-25-000006
Chunk: 34

Company: RISKIFIED LTD.
Filing Date: 2025-03-06
Form: 20-F
Item: Item 3
Chunk 34
---
 jurisdictions may claim that we are required to comply with their privacy and data protection laws, including in jurisdictions where we have no local entity, employees or infrastructure. In such cases, we may require additional legal review and resources to ensure compliance with any applicable privacy or data protection laws and regulations. In addition, in many jurisdictions there may in the future be new legislation that may affect our business and require additional legal review.

China

We are subject to various Chinese laws and regulations which impose strict requirements on cybersecurity, data handling and Personal Information protection. For example, under China’s Cybersecurity Law (“ CSL”), any collection, use, transfer and storage of Personal Information of a Chinese citizen through a network by the network operator should be based on the three principles of legitimacy, justification and necessity and requires the consent of the data subject.

China’s Data Security Law (“ DSL”) regulates data activities and entities and individuals carrying out data (including those relating to Personal Information) activities must abide by various data security obligations, including, to classify and protect data based on the importance of data to the state’s economic development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, or illegally acquired or used. The CSL and DSL both have a data localization requirement and require Personal Information processed by operators of critical information infrastructure (“ CIIOs”) and for important data collected and generated from within China to be stored locally in China unless a security assessment organized by the relevant authorities is passed. Finally, China’s Personal Information Protection Law (“ PIPL”) clarifies the scope of application, the definitions of Personal Information and sensitive Personal Information (which includes medical and health information), the legality of Personal Information processing and the basic requirements of notice and consent, among other things. The PIPL also requires Personal Information processors to rely on a data export mechanism and comply with certain requirements prior to the transfer of Personal Information outside of China, such as compliance with a security assessment or certification by an agency designated by the relevant authorities or entering into standard form model contracts approved by the relevant authorities with the overseas recipient, unless an exemption under the Provisions for Promoting and Regulating Cross-Border Data Flows applies.

In addition to the CSL, DSL and the PIPL, the Chinese government authorities promulgated several regulations or released a number of draft regulations for public comments which are designed to provide further implemental guidance in accordance with the laws mentioned above. For example, the Regulations on Network