On July 1, 2015, the Standing Committee of the National People's Congress issued the National Security Law, which came into effect on the same day. The National Security Law provides that the state shall safeguard its sovereignty, security and cybersecurity development interests, and that the government shall establish a national security review and supervision system to review, among other things, foreign investment, key technologies, internet and information technology products and services, and other important activities that are likely to impact the national security of China.
On November 7, 2016, the Standing Committee of the National People's Congress issued the Cyber Security Law, which came into effect on June 1, 2017. This is the first Chinese law that focuses exclusively on cyber security. The Cyber Security Law provides that network operators must set up internal security management systems that meets the requirements of a classified protection system for cybersecurity, including appointing dedicated cybersecurity personnel, taking technical measures to prevent computer viruses, network attacks and intrusions, taking technical measures to monitor and record network operation status and cybersecurity incidents, and taking data security measures such as data classification, backups and encryption. The Cyber Security Law also imposes a relatively vague but broad obligation to provide technical support and assistance to the public and state security authorities in connection with criminal investigations or for reasons of national security. The Cyber Security Law also requires network operators that provide network access or domain name registration services, landline or mobile phone network access, or that provide users with information publication or instant messaging services, to require users to provide a real identity when they sign up.
The Cyber Security Law sets high requirements for the operational security of facilities deemed to be part of the PRC's "critical information infrastructure." These requirements include data localization, i.e., storing personal information and important business data in China, and national security review requirements for any network products or services that may have an impact on national security. Among other factors, "critical information infrastructure" is defined as critical information infrastructure, that will, in the event of destruction, loss of function or data leak, result in serious damage to national security, the national economy and people's livelihood, or the public interest. Specific reference is made to key sectors such as public communication and information services, energy, transportation, water-resources, finance, public service and e-government.
On July 30, 2021, the State Council of the People's Republic of China issued the Regulations on Security Protection of Critical Information Infrastructures, which came into effect on September 1, 2021. The Regulations on Security Protection of Critical Information Infrastructures provides that "critical information infrastructure" shall be identified by the "protection work departments" (the competent departments and supervision and administration departments of the important industries and fields, such as public communication and information service, energy, transportation, water resources, finance, public services, e-government affairs, science, technology and industry for national defense as well as other important network facilities and information system, etc. of which the destruction, loss of function and data divulgence may seriously endanger national security, people's livelihood and public interests). A "protection work department" shall, in light of the actualities of the industry or field concerned, formulate the rules for identification of "critical information infrastructure" and submit the same to the public security department of the State Council for record-filing, and shall take the following factors into consideration in the rule formulating work: 1) Degree of importance of the network facilities and information system to the critical and core business of the industry or field concerned; 2) Extent of harm likely to be caused once the network facilities and information system, etc. are destroyed, lose functions or divulge data; and; 3) Correlation effect on other industries and fields. However, no official guidelines as to the scope of "critical information infrastructure" or identification rules of the "critical information infrastructure" of our industry or field have been formally issued.
We do not believe that we are an operator of "critical information infrastructure" as defined in the Cyber Security Law and the Regulations on Security Protection of Critical Information Infrastructures. However, there is no assurance that we may not be considered an operator of "critical information infrastructure" in the future as the definition is not precise, and there are substantial uncertainties as to the ultimate interpretation and implementation of the Cyber Security Law and the Regulations on Security Protection of Critical Information Infrastructures. If we are identified as an operator of "critical information infrastructure" accordingly, it could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business.
On November 14, 2021, CAC published Regulations for the Administration of Network Data Security (Draft for public comment, hereinafter the "Draft"). Article 2 of the Draft stipulates that "these Regulations apply to data processing activities carried out through networks as well as the supervision and regulation of network data security within the territory of the People's Republic of China." We do not believe the current business of CLPS involves any "data processing activities". In the foreseeable future, it is our understanding that CLPS will not engage in "data process activities". Therefore, we believe that the Draft does not apply to CLPS. The Draft has no substantial impact on the business of CLPS.
In December 2021, the CAC promulgated the amended Measures of Cybersecurity Review which require cyberspace operators with personal information of more than one million users to file for cybersecurity review with the CRO, in the event such operators plan for an overseas listing. The amended Measures of Cybersecurity Review provide that, among others, an application for cybersecurity review must be made by an issuer that is a "network platform operator" as defined therein before such issuer's securities become listed in a foreign country, if the issuer possesses personal information of more than one million users, and that the relevant governmental authorities in the PRC may initiate cybersecurity review if such governmental authorities determine an operator's cyber products or services or data processing activities affect or may affect China's national security. The amended Measures of Cybersecurity Review took effect on February 15, 2022.
On March 22, 2024, the CAC promulgated the Regulation to Standardize and Promote Cross-border Data Flow (hereinafter the "Regulation"). The Regulation mainly focus on specifying those scenarios which are not required to apply for security assessment for data to be provided abroad, to conclude a standard contract for personal information to be provided abroad or to pass the certification for personal information protection. It is remarkable that, according to Article 5 of the Regulation, a data processor providing personal information abroad may be exempted from proceeding the aforementioned processes if it satisfies any of the following conditions: (1) Where it is really necessary to provide personal information abroad for the purpose of concluding or performing a contract to which an individual concerned is a party, such as cross-border shopping, cross-border delivery, cross-border remittance, cross-border payment, cross-border account opening, air ticket and hotel reservation, visa handling and examination services; (2) Where it is really necessary to provide employees' personal information abroad for the purpose of conducting cross-border human resources management in accordance with the employment rules and regulations formulated in accordance with the law and collective contracts concluded in accordance with the law; (3) Where it is really necessary to provide personal information abroad in an emergency to protect the life, health and property safety of a natural person; or (4) Where a data processor other than a critical information infrastructure operator provides abroad the personal information (excluding sensitive personal information) of not more than 100,000 persons accumulatively as of January 1 of the current year. And, for the purpose of the preceding paragraph, "personal information provided abroad" does not include critical data. However, according to Article 10 of the Regulation, to provide personal information abroad, a data processor shall, in accordance with laws and administrative regulations, perform obligations such as notification, obtaining individual consent and conducting assessment of impact of personal information protection. Also, Article 2 of the Regulation stipulates that "If the data have not been informed or publicly announced as critical data by relevant departments or regions, data processors are not required to declare security assessment for cross-border provision of the data as critical data." according to which, the standard for identifying important data is clarified. Therefore, we understand that, as CLPS has not received any such notification from relevant departments or regions, and the data that it processes has not been publicly announced as critical data, CLPS shall not be recognized as a "critical data processor".
Currently, the cybersecurity laws and regulations have not directly affected our business and operations. As the amended Measures of Cybersecurity Review took effect in February 2022, we may be subject to review when conducting data processing activities, and may face challenges in addressing its requirements and make necessary changes to our internal policies and practices in data processing. As of the date of this Form 20-F, we have not been involved in any investigations on cybersecurity review made by the CAC on such basis, and we have not received any inquiry, notice, warning, or sanctions in such respect. Based on the foregoing, we and our PRC legal counsel do not expect that, as of the date of this Form 20-F, the current applicable PRC laws on cybersecurity would have a material adverse impact on our business.