Company: NTCL
Filing Date: 2025-02-18
Form Type: 20-F
Source: 0001410578-25-000153
Chunk: 107

Company: NetClass Technology Inc
Filing Date: 2025-02-18
Form: 20-F
Item: Item 5
Chunk 107
---
 and that involves privacy of citizens. No organization or individual may obtain the personal electronic information of citizens by steal or other illegal means, nor sell or illegally provide certain information others. The Decision further set out the requirement for the internet service providers.

Cyber Security Law

The SCNPC promulgated the Cyber Security Law in November 2016, which became effective in June 2017, to protect cyberspace security and order. Pursuant to the Cyber Security Law, any individual or organization using the network must comply with the Constitution and the applicable laws, follow the public order and respect social moralities, and must not endanger cyber security, or engage in activities by making use of the network that endanger the national security, honor and interests, or infringe on the fame, privacy, intellectual property and other legitimate rights and interests of others.

Table of Contents

Data Security Law

The Data Security Law of the PRC, which was promulgated by the SCNPC in June 2021 and took effect in September 2021, provides that the PRC shall establish a data classification and grading protection system, formulate the important data catalogs to enhance the protection of important data. Processors of important data shall specify the person responsible for data security and management agencies to implement data security protection responsibilities. Relevant authorities will establish the measures for the cross-border transfer of important data. If any company violates the Data Security Law of the PRC to provide important data outside the PRC, such company may be punished by administration sanctions, including penalties, fines, and/or suspension of relevant business or revocation of the business license.

On July 7, 2022, the CAC promulgated the Measures for Security Assessment for Cross-border Data Transfer (the “ Measures”), which took effect on September 1, 2022. According to the Measures, a data processor shall apply to the competent cyberspace department for security assessment and clearance of the outbound data under any of the following circumstances: (i) outbound transfer of important data by a data processor; (ii) outbound transfer of personal information by an operator of critical information infrastructure or a data processor which has processed more than one million users’ personal data; (iii) outbound transfer of personal information by a data processor which has made outbound transfers of more than one hundred thousand users’ personal information or more than ten thousand users’ sensitive personal information cumulatively since January 1 of the previous year, or (iv) such other circumstances where ex-ante security assessment and evaluation of cross-border data transfer