Company: DDC
Filing Date: 2025-10-24
Form Type: F-1
Source: 0001213900-25-102214
Chunk: 194

Company: DDC Enterprise Ltd
Filing Date: 2025-10-24
Form: F-1
Chunk 194
---
 times the advertising fee or a fine of not less than RMB1,000,000 but not more than RMB2,000,000 shall be imposed, and the SAMR or its local branches may revoke offenders’ business licenses, and revoke the advertisement examination and approval documents and refuse to accept their application for advertisement examination within one year. Regulations on Information Security The SCNPC promulgated the Cyber Security Law of the PRC or the Cyber Security Law, which became effective on June 1, 2017, to protect cyberspace security and order. Pursuant to the Cyber Security Law, any individual or organization using the network must comply with the constitution and the applicable laws, follow the public order and respect social moralities, and they must not endanger cyber security, or engage in activities that, by making use of the network, endanger the national security, honor and interests, or infringe on the fame, privacy, intellectual property and other legitimate rights and interests of others. The Cyber Security Law sets forth various security protection obligations for network operators, which are defined as “owners and administrators of networks and network service providers.” Such security protection obligations include, among others, complying with a series of requirements of tiered cyber protection systems, verifying users’ real identity, localizing the personal information and important data gathered and produced by key information infrastructure operators during operations within the PRC, and providing assistance and support to government authorities where it is necessary for the protection of national security and investigation of crimes. The Data Security Law of the PRC, which was promulgated by the SCNPC on June 10, 2021 and took effect on September 1, 2021, provides that China shall establish a data classification and grading protection system, formulate the important data catalogs to enhance the protection of important data. The conduct of data handling activities shall be 117 in compliance with the provisions of laws and administrative regulations, establishing and completing a data security management system for the entire workflow, organizing and conducting data security education and training, adopting corresponding technical measures and other necessary measures to ensure data security, strengthening risk monitoring, taking immediately disposition measures and promptly reporting to relevant authorities when data security incidents occur. Processors of important data shall specify the person responsible for data security and management agencies, implement data security protection responsibilities, periodically conduct risk assessments of such data handling activities as provided and submit risk assessment reports to the relevant authorities. Relevant authorities will establish the measures for the cross -bordertransfer of import data. If any company violates the Data Security Law of the