Company: EZOO
Filing Date: 2025-05-15
Form Type: 10-K
Source: 0001641172-25-010460
Chunk: 479

Company: Ezagoo Ltd
Filing Date: 2025-05-15
Form: 10-K
Item: Item 1
Chunk 479
---
 information and other data. Such covered data is wide ranging and relates to our investors,
employees, contractors and other third parties. The relevant PRC laws apply not only to third-party transactions, but also to transfers
of information between Ezagoo Nevada, offshore subsidiaries, our PRC subsidiaries, and other parties with which we have commercial relations.

The
PRC regulatory and enforcement regime with regard to privacy and data security is evolving. The PRC Cybersecurity Law, which was promulgated
on November 7, 2016 and became effective on June 1, 2017, provides that personal information and important data collected and generated
by operators of critical information infrastructure in the course of their operations in the PRC should be stored in the PRC, and the
law imposes heightened regulation and additional security obligations on operators of critical information infrastructure.

11

On
November 14, 2021, the CAC published the Regulations of Internet Data Security Management (Draft for Comments), which further regulate
the internet data processing activities and emphasize the supervision and management of network data security, and further stipulate
the obligations of internet platform operators, such as to establish a system for disclosure of platform rules, privacy policies and
algorithmic strategies related to data. Specifically, the draft regulations require data processors to, among others, (i) adopt immediate
remediation measures when finding that network products and services they use or provide have security defects and vulnerabilities, or
threaten national security or endanger public interest, and (ii) follow a series of detailed requirements with respect to processing
of personal information, management of important data and proposed overseas transfer of data. In addition, the draft regulations require
data processors handling important data or the data processors to be listed overseas to complete an annual data security assessment and
file a data security assessment report to applicable regulators. Such annual assessment, as required by the draft regulations, would
encompass areas including, but not limited to, the status of important data processing, data security risks identified and the measures
adopted, the effectiveness of data protection measures, the implementation of national data security laws and regulations, data security
incidents that occurred and their handling, and a security assessment with respect to sharing and provision of important data overseas.
As of the date of this report, the draft regulations have been released for public comment only and have not been formally adopted. The
final provisions and the timeline for its adoption are subject to changes and uncertainties.

We
currently operate three online platform, one