We and our customers that use our products may be subject to privacy, cybersecurity and data protection- related laws and regulations that impose obligations in connection with the collection, processing and use of personal data, financial data, health or other similar data and general cybersecurity. The PRC government and governments in other countries have adopted or proposed limitations on, or requirements regarding, the collection, distribution, use, security and storage of information, including personally identifiable information of individuals. In the PRC, the PRC Cybersecurity Law and relevant regulations require network operators, which may include us, to ensure the security and stability of the services provided via network and to provide assistance and support in accordance with the law for public security and national security authorities to protect national security or assist with criminal investigations.
In recent years, the PRC government has increasingly tightened the regulation of data privacy and data protection. The laws, regulations and governmental policies in the PRC for the data privacy and data protection are constantly evolving. For example, in June 2017, the PRC Cybersecurity Law promulgated by the Standing Committee of the National People's Congress (the "SCNPC"), took effect. The PRC Cybersecurity Law requires network operators to perform certain functions related to cybersecurity protection. In addition, the PRC Cybersecurity Law provides that the critical information infrastructure operators generally shall, during their operations in the PRC, store the personal information and important data collected and produced within the territory of PRC, and shall conduct security assessment for cross-border data transfer. See "Item 4. Information on the Company - Government Regulations - Regulation on Information Security and Censorship." On August 20, 2021, the SCPNC adopted the Personal Information Protection Law (the "PIPL"), which became effective on November 1, 2021. The PIPL stipulates that personal information processors who provide significant internet platform services, have a large user base and/or operate complex types of businesses are subject to certain obligations, such as establishing an internal personal information protection system in compliance with relevant laws, rules and regulations; and releasing social responsibility reports on personal information protection on a regular basis. See "Item 4. Information on the Company - Government Regulations -Regulation on Privacy Protection" Existing PRC laws and regulations do not provide clear parameters as to what constitutes "large user base" and/or "complex types of businesses." Nevertheless, it is widely accepted in practice that at least one million users is required in order to reach the "large user base" threshold, and "complex types of businesses" usually refers to a business model under which a company either operates as an integrated online platform, for example, a social media or e-commerce platform, or operates with diversified business lines or product catalogues. We believe that we are not a personal information processor who has a large user base and/or operate complex types of businesses. However, since there has been no official interpretation or explanation as to the definition of same, it remains uncertain whether we would be deemed as a personal information processor who has a large user base and/or operate complex types of businesses by the PRC regulatory authorities, thus requiring us to perform the obligations stipulated under the PIPL.
On July 7, 2022, the Security Assessment Measures for Outbound Data Transfer was released by the CAC, which became effective on September 1, 2022, stipulates that before cross-border data transfer under certain circumstances, data processors shall make self-assessment of the risks, and shall apply for security assessment. These laws and regulations require, among others, that the personal information and important data generated and collected during the operations in the PRC should be stored within the PRC unless, prior to the intended data transfer, certain specified criteria have been satisfied, such as a completed official security assessment carried out by the PRC government authorities. As a personal information processor defined under the PIPL, while we do not believe current business involves any transmission, use and exchange of information that comes under the definition of "cross-border transfer of personal information and important data" under the PRC Cybersecurity Law, we cannot assure you that the PRC regulatory authorities will not take a view contrary to our view, thus requiring us to comply with the data localization, security assessment and other requirements under these laws and regulations. As our business continues to grow, there may arise circumstances where we engage in such cross-border transfer of personal data and/or important data, including in order to satisfy the legal and regulatory requirements, in which case we may need to comply with the foregoing requirements as well as any other limitations under PRC laws then applicable. Complying with these laws and requirements could cause us to incur substantial expenses or require us to alter or change our practices in ways that could harm our business. Additionally, to the extent we are found to be not in compliance with these laws and requirements, we may be subject to fines, regulatory orders to suspend our operations or other regulatory and disciplinary sanctions, which could materially and adversely affect our business, financial condition and results of operations.
On December 28, 2021, the CAC, together with 12 other government authorities, jointly issued the Review Measures, which became effective on February 15, 2022. Pursuant to the Review Measures, "critical information infrastructure operators" who procure internet products and services that affect or may affect national security and any "network platform operators" carrying out data processing activities that affect or may affect national security shall be subject to cybersecurity review requirements. See "Item 4. Information on the Company - Government Regulations - Regulation on Information Security and Censorship."
On September 24, 2024, the State Council promulgated the Network Data Security Management Regulation, which will come into effect on January 1, 2025. According to the Network Data Security Management Regulation, the national data security coordination mechanism coordinates relevant departments to formulate important data catalogues and strengthen the protection of important data; all regions and departments shall, in accordance with the data classification and classification protection system, determine the specific catalogue of important data in their own regions, departments and related industries and fields, and focus on the protection of network data included in the catalogue. Where network data processors carry out network data processing activities that affect or may affect national security, they shall go through a national security review in accordance with relevant PRC regulations. See "Item 4. Information on the Company - Government Regulations - Regulation on Information Security and Censorship."
It remains uncertain what kind of data constitutes "Important Data." Also, there is no further explanation or interpretation as to how to determine what constitutes "affecting national security." Therefore, it is uncertain whether we would be deemed as a "Important Data Processors" and need to fulfill the obligations that the Important Data Processor should perform, whether we would be deemed as a "critical information infrastructure operator" or a "network platform operator" or a "data processors" holding one million users' personal information, or whether our business will be deemed to affect or may affect national security under PRC laws, thus requiring us to go through a national security review or cybersecurity review process.
We currently do not have over one million users' personal information and do not anticipate that we will be collecting over one million users' personal information in the foreseeable future. As of the date of this annual report, we have not been informed by any PRC government authorities that we will be deemed as an Important Data Processor or a critical information infrastructure operator. It also remains uncertain whether future regulatory changes would impose additional restrictions on companies like us. We cannot predict the impact of the Review Measures and the Network Data Security Management Regulations, if any, at this stage. We will closely monitor and assess any development in the rulemaking process. If the Review Measures and the Network Data Security Management Regulations mandate clearance of a cybersecurity review and other specific actions to be completed by China-based companies listed on a foreign stock exchange like us, we face uncertainties as to whether such clearance can be timely obtained, or at all. As of the date of this annual report, we have not been involved in any formal investigations on cybersecurity review made by the CAC. If we are not able to comply with the cybersecurity and data privacy requirements in a timely manner, or at all, we may be subject to government enforcement actions and investigations, fines, penalties, suspension of our non-compliant operations, or removal of our applications from the relevant application stores, among other sanctions, which could materially and adversely affect our business and results of operations.
In November 2021, one of our applications, "Cloud Classroom," was tested and determined to be in violation of the relevant regulations relating to the collection of personal information by National App Technology Testing Platform, which is an official platform under the MIIT. Upon receipt of the notice, we immediately conducted thorough reviews on relevant systems and made rectifications. In February 2022, such application was listed on a notice of criticism circulated by the MIIT, which determined that we violated relevant regulations in using users' personal information and mandatorily, frequently and excessively requesting for permissions of users' personal information. We reviewed our application system immediately and carried out rectification measures. The rectified application was recognized and approved by the MIIT in March 2022.
Pursuant to the PIPL, where personal information is handled in violation of this law or personal information is handled without fulfilling personal information protection duties in accordance with the provisions, the departments fulfilling personal information protection duties and responsibilities are to order correction, confiscate unlawful income, and order the provisional suspension or termination of service provision of the application programs unlawfully handling personal information. The above-mentioned matters have neither caused the cessation of any of our applications nor adversely affected our business and results of operations.
Further, in many cases we rely on the data processing, privacy, data protection and cybersecurity practices of our suppliers and contractors, including with regard to maintaining the confidentiality, security and integrity of data. If we fail to manage our suppliers or contractors or their relevant practices, or if our suppliers or contractors fail to meet any requirements with regard to data processing, privacy, data protection or cybersecurity required by applicable legal or contractual obligations that we face (including any applicable requirements of our clients), we may be liable in certain cases. We may face difficulties in binding our suppliers and contractors to these agreements and otherwise managing their relevant practices, which may subject us to claims, proceedings and liabilities.
Any failure or perceived failure by us, our products or our platform to comply with new or existing cybersecurity or data protection laws, regulations, policies, industry standards or legal obligations in the PRC, any failure to bind our suppliers and contractors to appropriate agreements or to manage their practices or any systems failure or security incident that results in the unauthorized access to, or acquisition, release or transfer of, personally identifiable information or other data relating to customers or individuals may result in governmental investigations, inquiries, enforcement actions and prosecutions, private claims and litigation, fines and penalties, adverse publicity or potential loss of business.