Following the divestiture of the Greater China assets and business operations, we use a limited number of third-party data centers in China to host our servers. As a result, we are subject to China's data privacy and cybersecurity laws, regulations and guidelines. In China, regulatory authorities have implemented and are considering a number of legislative and regulatory proposals concerning data protection. For example, China's Cyber Security Law, which became effective in June 2017, created China's first national-level data protection for "network operators," which may include all organizations in China that provide services over the internet or another information network. The Data Security Law, which became effective in September 2021, among other things, provides for a security review procedure for the data activities that may affect national security. In addition, the Civil Code of the PRC, which became effective on January 1, 2021, expressly provides the right of privacy and personal information protection. The PRC Cyber Security Law, the Data Security Law and Civil Code are relatively new and subject to interpretation by the regulators. Although we only gain access to user information that is necessary for, and relevant to, the businesses conducted, the data we obtain and use may include information that is deemed as "personal information" or "important data" under the PRC Cyber Security Law, the Civil Code and related data privacy and protection laws and regulations.
In addition, certain industry-specific laws and regulations affect the collection and transfer of personal data in China. For example, Regulations on the Administration of Human Genetic Resources, effective in July 2019, the latest amended edition of which will come into effect on May 1, 2024, require approval from the Science and Technology Administration Department of the State Council where human genetic resources are involved in any international collaborative project and additional approval for any export or cross-border transfer of the samples of human genetic resources or associated data. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices, potentially resulting in confiscation of samples of human genetic resources and associated data, administrative fines and criminal liabilities.
Furthermore, in December 2021, the CAC and several other authorities jointly promulgated the revised Cybersecurity Review Measures, which came into effect in February 2022. Pursuant to the Cybersecurity Review Measures, a critical information infrastructure operator that purchases network products and services, or an internet platform operator that conducts data processing activities, shall be subject to cybersecurity review if it affects or may affect national security. In addition, internet platform operators processing personal information of more than one million users seeking to be listed on foreign stock markets must apply for a cybersecurity review. As of the date of this annual report, (i) no detailed rules or implementation relating to the Cybersecurity Review Measures has been issued by any PRC regulatory authorities, (ii) we have not been informed of being identified as a critical information infrastructure operator or an internet platform operator, nor have we been required to go through the cybersecurity review procedures, by any PRC governmental authorities, and (iii) we have not been involved in any investigations on cybersecurity review on such basis, nor have we received any inquiry, notice, warning, or sanctions in such respect, by any PRC governmental authorities. Taking into consideration the above and that (i) the preclinical and clinical data processed or handled by us in our business operations, either by its nature or in scale, do not and will not directly or indirectly affect or potentially affect national security in any respect, and (ii) we have not possessed, and do not anticipate to possess, in the foreseeable future, personal information of more than one million users or persons, based on our understanding of the Cybersecurity Review Measures, we do not expect that we will be subject to cybersecurity review by the CAC in connection with our offering of securities to foreign investors and listing on the Nasdaq. Nevertheless, the exact scope of critical information infrastructure operator and "internet platform operator" under the current regulatory regime remains unclear, and the PRC governmental authorities may have wide discretion to decide the identification of critical information infrastructure operator as well as in the interpretation and enforcement of the Cybersecurity Review Measures and other laws, regulations and implementation rules. Therefore, it is uncertain whether we would be deemed as a critical information infrastructure operator or an internet platform operator thereunder.
Since 2022, the CAC also promulgated a series of rules and regulations on outbound data transfer, outlining the regulatory framework and providing detailed guidance. A data processor is subject to different regulatory requirements, depending on the nature, sensitivity and volume of the data to be transferred. See "Item 4.-Information on the Company-B. Business Overview-Regulation-PRC Regulation."
The PRC laws and regulations concerning data privacy and cybersecurity are continually evolving and not always clear, and the measures we take to comply with these laws, regulations and industry standards may not always be effective. We cannot assure you that we will comply with such laws and regulations regarding cybersecurity, information security, privacy and data protection in all respects and any failure or perceived failure to comply with these laws, regulations or policy may result in inquiries, penalties and other proceedings or actions against us by governmental authorities, such as warnings, fines, making certain required rectification, service suspension and/or other sanctions, as well as negative publicity and damage to our reputation. It also remains uncertain whether the future regulatory changes would impose additional restrictions on companies like us. We cannot predict the impact of the future regulatory changes, including impact of any draft measures, at this stage, and we will closely monitor and assess any development in the rule-making process. If additional requirements are imposed to companies like us, such as the clearance of cybersecurity review, we face uncertainties as to whether we can fulfill those requirements in a timely manner, or at all. If we are not able to comply with the cybersecurity and data privacy requirements in a timely manner, or at all, we may be subject to government enforcement actions and investigations, fines, penalties or suspension of our non-compliant operations, which could materially and adversely affect our business and results of operations.