Company: VSA
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001410578-25-001300
Chunk: 36

Company: VisionSys AI Inc
Filing Date: 2025-05-15
Form: 20-F
Item: Item 3
Chunk 36
---
 personal information transferred overseas by a critical information infrastructure operator and a data processor that has processed personal information of more than one million individuals; (iii) personal information transferred overseas by a data processor who has already provided personal information of 100,000 persons or sensitive personal information of 10,000 persons overseas since January 1 of the previous year; or (iv) other circumstances as requested by the CAC.

25

On March 22, 2024, CAC published the Provisions on Promoting and Regulating Cross-border Data Flows, which took effective on the same date. The provisions provide several exemptions from undergoing data security assessment, obtaining personal information protection certification or entering into standard contract for outbound transfer of personal information for businesses. These exemptions include, among others, the scenario where a data processor, other than a CIIO, has cumulatively transferred overseas personal information, excluding sensitive personal information, of fewer than 100,000 individuals since January 1 of the current year. A data processor intending to implement outbound data transfer under the following circumstances should apply for security assessment to the CAC: (i) a CIIO intending to provide personal information or important data abroad; or (ii) a data processor that is not a CIIO intending to provide important data abroad, or has since January 1 of the current year cumulatively provided personal information (excluding sensitive personal information) of over one million individuals, or sensitive personal information of over 10,000 individuals, abroad. The provisions also explicitly state that data processors are not required to conduct data security assessment for cross-border transfer of important data if the data has not been notified or published as important data by relevant departments or regions. In addition, for any data processors other than the CIIOs who have since January 1 of the current year cumulatively provided personal information (excluding sensitive personal information) of over 100,000 and less than one million individuals, or sensitive personal information of less than 10,000 individuals abroad, should execute a standard contract for outbound transfer of personal information with the recipient abroad or pass the certification for personal information protection.
Furthermore, on March 22, 2024, the CAC promulgated the Guide to Applications for Security Assessment of Outbound Data Transfers (Second Edition), which provides that any of the following circumstances is deemed as the act of outbound data transfers: (i) a data processor transfers abroad the data collected and generated from its operation within the territory of China; (ii) the data collected and generated by the