Company: GDHLF
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001410578-25-000935
Chunk: 199

Company: GDS Holdings Ltd
Filing Date: 2025-04-28
Form: 20-F
Item: Item 4
Chunk 199
---
 operator by the Protection Departments, and notified to the public security department of the State Council as well.

On July 7, 2022, the CAC promulgated the Measures for the Security Assessment of Data Cross-border Transfer, and it became effective on September 1, 2022, which requires data processors apply to the national cyberspace administration through the local cyberspace administration at the provincial level under any of the following circumstances: (i) the data processor provides important data abroad, (ii) the critical information infrastructure operator or the data processor that has processed the personal information of over one million people provides personal information abroad, (iii) the data processor that has provided the personal information of over 100,000 people or the sensitive personal information of over 10,000 people cumulatively since January 1 of the previous year provides personal information abroad, or (iv) any circumstance where an application for the security assessment of outbound data transfer is required by the national cyberspace administration. PRC government authorities may have wide discretion in the interpretation and enforcement of the Security Assessment Measures, including whether we have exported “important data” as defined thereunder, and thus there is uncertainty as to whether we may be subject to security assessment. As there are still uncertainties regarding the further enactment of new laws and regulations as well as the revision, interpretation and implementation of those existing laws and regulations, we cannot assure that whether these provisions will be applicable to us.

Table of Contents

On September 24, 2024, the State Council promulgated the Cyber Data Security Regulations, which became effective on January 1, 2025, and it specifies that cyber data processors refer to individuals or organizations that autonomously determine the purpose and the manner of processing cyber data. According to the Cyber Data Security Regulations, cyber data processors shall, in accordance with the provisions of laws and administrative regulations and the mandatory requirements of national standards, and on the basis of classified protection of cyber security, strengthen the protection of cyber data security, establish and perfect the system of cyber data security management, and take technical measures such as encryption, backup, access control and security authentication as well as other necessary measures to protect cyber data from being falsified, destroyed, divulged or illegally acquired or used, dispose of cyber data security incidents, prevent illegal and criminal activities aiming at and using cyber data, and assume primary responsibility for the security of the cyber data processed by them. Furthermore, cyber data processors that provides services for state agencies or critical information infrastructure operators, or participates