Company: QSEA
Filing Date: 2025-03-11
Form Type: S-1/A
Source: 0001829126-25-001676
Chunk: 77

Company: Quartzsea Acquisition Corp
Filing Date: 2025-03-11
Form: S-1/A
Chunk 77
---
 in 2021 that would require companies collecting or holding large amounts of data to undergo a cybersecurity review prior to listing in foreign countries, a move that would significantly tighten oversight over large China-based internet companies. On November 14, 2021, the CAC publicly solicited opinion on the Regulation on Network Data Security Management (Consultation Draft), which stipulated that data processors that undertake data processing activities using internet networks within China are required to apply for cybersecurity review if it conducts data processing activities that will or may have an impact on China’s national security. The review is mandatory if the data processor controls more than 1 million users’ personal information and intends to be listed in a foreign country, or if the data processor seeks to be listed in Hong Kong. As of the date of this prospectus, the Draft Regulation on Network Data Security Management has not been formally adopted. On December 28, 2021, the CAC, jointly with 12 departments under the State Council, implemented the Measures for Cybersecurity Review, which became effective on February 15, 2022. According to the Measures for Cybersecurity Review, operators of critical information infrastructure purchasing network products and services, and data processors carrying out data processing activities that affect or may affect China’s national security, are required to conduct a cybersecurity review. Operators, including operators of critical information infrastructure and data processors, who control more than 1 million users’ personal information must report to the Cyber Security Review Office for a cybersecurity review if it intends to be listed in a foreign country.

On June 10, 2021, the Standing Committee of the PRC National People’s Congress, or SCNPC, promulgated the PRC Data Security Law, which took effect in September 2021. The PRC Data Security Law imposes data security and privacy obligations on entities and individuals carrying out data activities, and introduces a data classification and hierarchical protection system based on the importance of data in economic and social development, and the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, illegally acquired or used. The PRC Data Security Law also provides for a national security review procedure for data activities that may affect national security and imposes export restrictions on certain data and information. On August 20, 2021, the SCNPC adopted the Personal Information Protection Law, which took effect as of November 1, 2021. The Personal Information Protection Law includes the basic rules for