Company: SOS
Filing Date: 2025-07-02
Form Type: S-8
Source: 0001213900-25-061032
Chunk: 35

Company: SOS Ltd
Filing Date: 2025-07-02
Form: S-8
Chunk 35
---
 a person’s personal information obtained during the course of performing duties or providing services. Pursuant
to the PRC Cybersecurity Law, effective on June 1, 2017, network operators are required to fulfill certain obligations to safeguard cyber
security and enhance network information management. See “Item 4. Information on the Company — B. Business Overview —
Regulations — Regulations relating to internet information security and privacy protection” of the 2023 Form 20-F.

Moreover, existing PRC
privacy, cybersecurity and data protection-related laws and regulations are evolving and subject to potentially differing interpretations,
and various legislative and regulatory bodies may expand current or enact new laws and regulations regarding privacy, cybersecurity and
data protection-related matters. These developments could adversely affect our and the VIEs’ business, operating results and financial
condition. Any failure or perceived failure by us or the VIEs to comply with new or existing PRC privacy, cybersecurity or data protection
laws, regulations, policies, industry standards or legal obligations, or any systems failure or security incident that results in the
unauthorized access to, or acquisition, release or transfer of, personally identifiable information or other data relating to customers
or individuals may result in governmental investigations, inquiries, enforcement actions and prosecutions, private claims and litigation,
fines and penalties, adverse publicity or potential loss of business. For example, on June 10, 2021, the Standing Committee of the National
People’s Congress (the “Standing Committee of the NPC”), promulgated the PRC Data Security Law, which took effect in
September 2021. The PRC Data Security Law provides for data security obligations on entities and individuals carrying out data activities.
The PRC Data Security Law also introduces a national security review procedure for those data activities which may affect national security
and imposes export restrictions on certain data information. Furthermore, along with the promulgation of the Opinions on Strictly Cracking
Down Illegal Securities Activities in accordance with the Law, overseas-listed China-based companies are experiencing a heightened scrutiny
over their compliance with laws and regulations regarding data security, cross-border data flow and management of confidential information
from PRC regulatory authorities.

<div align='center'>15</div>

On August 20, 2021, the
Standing Committee of the NPC issued the Personal Information Protection Law, which has been effective from November 1, 2021 and reiterates
the circumstances under which a personal information processor could process personal information and the requirements for such circumstances