Company: SOS
Filing Date: 2025-07-31
Form Type: 424B5
Source: 0001213900-25-069766
Chunk: 76

Company: SOS Ltd
Filing Date: 2025-07-31
Form: 424B5
Chunk 76
---
 well as cybersecurity. The PRC regulators, including the MIIT and the CAC, have been increasingly focused on regulation
in the areas of cybersecurity and data protection and governmental authorities have enacted a series of laws and regulations to enhance
the protection of privacy and data, which require certain authorization or consent from users prior to collection, use or disclosure of
their personal data and also protection of the security of the personal data of such users. The MIIT issued the Order for the Protection
of Telecommunications and Internet User Personal Information on July 16, 2013, requiring internet service providers to establish and publish
protocols relating to the collection or use of personal information, keep any collected information strictly confidential and take technological
and other measures to maintain the security of such information. Institutions and their employees are prohibited from selling or otherwise
illegally disclosing a person’s personal information obtained during the course of performing duties or providing services. Pursuant
to the PRC Cybersecurity Law, effective on June 1, 2017, network operators are required to fulfill certain obligations to safeguard cyber
security and enhance network information management. See “Item 4. Information on the Company — B. Business Overview —
Regulations — Regulations relating to internet information security and privacy protection” of the 2023 Form 20-F.

Moreover, existing PRC privacy, cybersecurity
and data protection-related laws and regulations are evolving and subject to potentially differing interpretations, and various legislative
and regulatory bodies may expand current or enact new laws and regulations regarding privacy, cybersecurity and data protection-related
matters. These developments could adversely affect our and the VIEs’ business, operating results and financial condition. Any failure
or perceived failure by us or the VIEs to comply with new or existing PRC privacy, cybersecurity or data protection laws, regulations,
policies, industry standards or legal obligations, or any systems failure or security incident that results in the unauthorized access
to, or acquisition, release or transfer of, personally identifiable information or other data relating to customers or individuals may
result in governmental investigations, inquiries, enforcement actions and prosecutions, private claims and litigation, fines and penalties,
adverse publicity or potential loss of business. For example, on June 10, 2021, the Standing Committee of the National People’s
Congress (the “Standing Committee of the NPC”), promulgated the PRC Data Security Law, which took effect in September 2021.
The PRC Data Security Law provides for data security obligations on entities and individuals