Company: AEHL
Filing Date: 2025-08-05
Form Type: 20-F/A
Source: 0001641172-25-022290
Chunk: 33

Company: Antelope Enterprise Holdings Ltd
Filing Date: 2025-08-05
Form: 20-F/A
Chunk 33
---
 production,
operation and management of government affairs and enterprises in the process of the gradual transformation of digitalization and requires
that data collection shall be conducted in a legitimate and proper manner, and theft or illegal collection of data is not permitted. Data
processors shall establish and improve the whole-process data security management rules, organize and implement data security trainings
as well as take appropriate technical measures and other necessary measures to protect data security. In addition, data processing activities
shall be conducted on the basis of the graded protection system for cybersecurity.

On July 30, 2021, the State Council
promulgated the Regulations on Protection of Security of Critical Information Infrastructure, effective on September 1, 2021, under which,
a “critical information infrastructure” refers to critical network facilities and information systems involved in important
industries and sectors, such as public communication and information services, energy, transportation, water conservancy, finance, public
services, governmental digital services, science and technology related to national defense industry, as well as those which may seriously
endanger national security, national economy and citizen’s livelihood or public interests if damaged or malfunctioned, or if any
leakage of data in relation thereto occurs. The competent governmental departments and supervision and management departments of the aforementioned
important industries will be responsible for (i) organizing the identification of critical information infrastructures in their respective
industries in accordance with relevant identification rules, and (ii) promptly notifying the identified operators and the public security
department of the State Council of the identification results. In the event of occurrence of any major cybersecurity incident or discovery
of any major cybersecurity threat for the critical information infrastructure, the operator shall report to the protection authorities
and the public security authorities as required.

| 18 |

On July 7, 2022, the CAC promulgated
the Measures on Security Assessment of Cross-border Data Transfer which has become effective on September 1, 2022. Such data export measures
requires that any data processor which processes or exports personal information exceeding certain volume threshold under such measures
shall apply for security assessment by the CAC before transferring any personal information abroad, including the following circumstances:
(i) important data will be provided overseas by any data processor; (ii) personal information will be provided overseas by any operator
of critical information infrastructure or any data processor who processes the personal information of more than 1,000,000 individuals;
(iii) personal information will be provided overseas by any data processor who has provided