We may become subject to a variety of laws and regulations in the PRC regarding privacy, data security, cybersecurity, and data protection. These laws and regulations are continuously evolving and developing. The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting, particularly with respect to foreign laws. In particular, there are numerous laws and regulations regarding privacy and the collection, sharing, use, processing, disclosure, and protection of personal information and other user data. Such laws and regulations often vary in scope, may be subject to differing interpretations, and may be inconsistent among different jurisdictions.
We expect to obtain information about various aspects of our operations as well as regarding our employees and third parties. We also maintain information about various aspects of our operations as well as regarding our employees. The integrity and protection of our customer, employee and company data is critical to our business. Our customers and employees expect that we will adequately protect their personal information. We are required by applicable laws to keep strictly confidential the personal information that we collect, and to take adequate security measures to safeguard such information.
The PRC Criminal Law, as amended by its Amendment 7 (effective on February 28, 2009) and Amendment 9 (effective on November 1, 2015), prohibits institutions, companies and their employees from selling or otherwise illegally disclosing a citizen's personal information obtained during the course of performing duties or providing services or obtaining such information through theft or other illegal ways. On November 7, 2016, the Standing Committee of the PRC National People's Congress issued the Cyber Security Law of the PRC, or Cyber Security Law, which became effective on June 1, 2017.
Pursuant to the Cyber Security Law, network operators must not, without users' consent, collect their personal information, and may only collect users' personal information necessary to provide their services. Providers are also obliged to provide security maintenance for their products and services and shall comply with provisions regarding the protection of personal information as stipulated under the relevant laws and regulations.
The Civil Code of the PRC (issued by the PRC National People's Congress on May 28, 2020 and effective from January 1, 2021) provides main legal basis for privacy and personal information infringement claims under the Chinese civil laws. PRC regulators, including the Cyberspace Administration of China, MIIT, and the Ministry of Public Security have been increasingly focused on regulation in the areas of data security and data protection.
The PRC regulatory requirements regarding cybersecurity are constantly evolving. For instance, various regulatory bodies in China, including the Cyberspace Administration of China, the Ministry of Public Security and the SAMR, have enforced data privacy and protection laws and regulations with varying and evolving standards and interpretations. In April 2020, the Chinese government promulgated Cybersecurity Review Measures, which came into effect on June 1, 2020. According to the Cybersecurity Review Measures, operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services which do or may affect national security.
In November 2016, the Standing Committee of China's National People's Congress passed China's first Cybersecurity Law ("CSL"), which became effective in June 2017. The CSL is the first PRC law that systematically lays out the regulatory requirements on cybersecurity and data protection, subjecting many previously under-regulated or unregulated activities in cyberspace to government scrutiny. The legal consequences of violation of the CSL include penalties of warning, confiscation of illegal income, suspension of related business, winding up for rectification, shutting down the websites, and revocation of business license or relevant permits. In April 2020, the Cyberspace Administration of China and certain other PRC regulatory authorities promulgated the Cybersecurity Review Measures, which became effective in June 2020. Pursuant to the Cybersecurity Review Measures, operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services which do or may affect national security.
On June 10, 2021, the Standing Committee of the NPC promulgated the PRC Data Security Law, which took effect on September 1, 2021. The Data Security Law also sets forth the data security protection obligations for entities and individuals handling personal data, including that no entity or individual may acquire such data by stealing or other illegal means, and the collection and use of such data should not exceed the necessary limits The costs of compliance with, and other burdens imposed by, CSL and any other cybersecurity and related laws may limit the use and adoption of our products and services and could have an adverse impact on our business. Further, if the enacted version of the Measures for Cybersecurity Review mandates clearance of cybersecurity review and other specific actions to be completed by companies like us, we face uncertainties as to whether such clearance can be timely obtained, or at all.
On July 10, 2021, the Cyberspace Administration of China issued a revised draft of the Measures for Cybersecurity Review for public comments (the "Review Measures"), and on December 28, 2021, the Cyberspace Administration of China jointly with the relevant authorities published Measures for Cybersecurity Review (2021) which took effect on February 15, 2022 and replaced the Review Measures. Measures for Cybersecurity Review (2021) stipulates that operators of critical information infrastructure purchasing network products and services, and online platform operator (together with the operators of critical information infrastructure, the "Operators") carrying out data processing activities that affect or may affect national security, shall conduct a cybersecurity review, any online platform operator who controls more than one million users' personal information must go through a cybersecurity review by the cybersecurity review office if it seeks to be listed in a foreign country. Since we are not an Operator, nor do we control more than one million users' personal information, we would not be required to apply for a cybersecurity review under the Measures for Cybersecurity Review (2021).
Under the Data Security Law enacted on September 1, 2021 and the Measures for Cybersecurity Review (2021) implemented on February 15, 2022, since we are not an Operator, nor do we control more than one million users' personal information, we would not be required to apply for a cybersecurity review by the CAC. However, if the CSRC, CAC or other regulatory agencies later promulgate new rules or explanations requiring that we obtain their approvals for any follow-on offering, we may be unable to obtain such approvals and we may face sanctions by the CSRC, CAC or other PRC regulatory agencies for failure to seek their approval which could significantly limit or completely hinder our ability to offer or continue to offer securities to our investors and the securities currently being offered may substantially decline in value and be worthless.