We rely on our information technology systems to process, transmit and store electronic information (including sensitive data such as confidential business information and personally identifiable data relating to employees, customers, and other business partners), and to manage or support a variety of critical business processes and activities. We face various cybersecurity threats, including threats to our information technology infrastructure and attempts to gain access to our proprietary information, denial-of-service attacks, requests for money transfers, ransomware, as well as threats to the physical security of our facilities and employees. In addition, we face cyber threats from entities that may seek to target us through our customers, vendors, subcontractors, employees, and other third parties with whom we do business. We may experience cybersecurity threats such as viruses and attacks by hackers targeting our information technology systems. We can provide no assurance that our current information technology systems, or those of the third parties upon which we rely, are fully protected against such cyber security threats. Although such events have not had a material impact on our financial condition, results of operations or liquidity or reputation to date, future threats could, among other things: cause harm to our business and our reputation; disrupt our operations; expose us to potential liability, regulatory actions and the loss of business; as well as impact our results of operations materially. We believe such attempts are increasing in number and in technical sophistication. In some instances, we, our customers, and the users of our products and services might be unaware of an incident or its magnitude and effects. Due to the evolving nature of these security threats, we cannot predict the potential impact of any future incident.
While we take measures to protect the security of, and prevent unauthorized access to, our systems and personal and proprietary information, the security controls for our systems, as well as other security practices we follow, may not prevent unauthorized access to, damage to, disablement or encryption of, use or misuse of, disclosure of, modification of, destruction of or loss of our data or the data of others (including personally identifiable information and proprietary information). Any actual or perceived security incident could harm our business and operating results and could result in, among other things, unfavorable publicity, governmental inquiry and oversight, difficulty in marketing our services, allegations by our customers that we have not performed our contractual obligations, litigation by affected parties including our customers and possible financial obligations for damages related to the theft or misuse of such information or inventory, any of which could negatively impact our business, financial condition and results of operations.
Furthermore, data privacy is subject to frequently changing rules and regulations, which sometimes conflict among the various jurisdictions and countries in which we provide services. We are subject to a variety of local, state, national and international laws, directives and regulations that apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal data in the different jurisdictions in which we operate. Data privacy laws and regulations, including the European Union's General Data Protection Regulation, effective May 2018, the California Consumer Privacy Act, effective January 2020, and the California Privacy Rights and Enforcement Act of 2020, partially effective as of December 2020, pose increasingly complex compliance challenges, which may increase compliance costs, and any failure to comply with data privacy laws and regulations could result in significant penalties. In addition, we may be subject to new data privacy laws, such as, the Virginia
Consumer Data Protection Act and the Colorado Privacy Act. These and other similar state laws may encourage other states and the federal government to pass comparable legislation, introducing the possibility of greater penalties and more rigorous compliance requirements. Compliance with U.S. and international data protection laws and regulations could cause us to incur substantial costs or require us to change our business practices and compliance procedures in a manner adverse to our business. Any inability to adequately address data privacy or data protection, or other information security-related concerns, even if unfounded, or to successfully negotiate privacy, data protection or information security-related contractual terms with customers, or to comply with applicable laws, regulations and policies relating to privacy, data protection and information security, could result in additional cost and liability to us, harm our reputation and brand, and could negatively impact our business, financial condition and results of operations.
In addition, PRC regulatory authorities have implemented and are considering a number of legislative and regulatory proposals concerning data protection. For example, China's Cyber Security Law, which became effective in June 2017, established China's first national-level data protection for "network operators," which may include all organizations in the PRC that connect to or provide services over the internet or other information network. The Cyber Security Law requires network operators to perform certain functions related to cybersecurity protection. In addition, the Cyber Security Law imposes certain requirements on network operators of critical information infrastructure (CIIOs). For example, CIIOs generally shall, during their operations in the PRC, store the personal information and important data collected and produced within the territory of the PRC, and shall perform certain security obligations as required under the Cyber Security Law, including that the CIIOs shall pass the national security review when purchasing network product or service which may affect national security. In addition, China's Data Security Law, which was promulgated by the Standing Committee of the PRC National People's Congress (the SCNPC), on June 10, 2021 and became effective on September 1, 2021, outlines the main system framework of data security protection. For example, the Data Security Law introduces a data classification and hierarchical protection system based on the importance of data in economic and social development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, or illegally acquired or used. Processors of "important data" are further required to conduct periodic risk assessment and submit assessment report to relevant regulatory authorities. In addition, the Data Security Law provides a national security review procedure for those data activities which may affect national security. Furthermore, Regulations on the Security Protection of Critical Information Infrastructure (the CII Protection Regulations), which was promulgated by the State Council of the PRC on July 30, 2021 and became effective on September 1, 2021, stipulates the obligations and liabilities of the regulators, society and CIIOs in protecting the security of critical information infrastructure (the CII). According to the CII Protection Regulations, regulators supervising specific industries shall formulate detailed guidance to recognize the CII in the respective sectors, and CIIOs shall take the responsibility to protect the CII's security by performing certain prescribed obligations. For example, CIIOs are required to conduct network security test and risk assessment, report the assessment results to relevant regulatory authorities, and timely rectify the issues identified at least once a year.
The Opinions, which were issued by the General Office of the State Council and the General Office of the CPC Central Committee on July 6, 2021, require the speedup of the revision of the provisions on strengthening the confidentiality and archives coordination between regulators related to overseas issuance and listing of securities, and improvement to the laws and regulations related to data security, cross-border data flow, and management of confidential information. Numerous regulations, guidelines and other measures have been or are expected to be adopted under the umbrella of, or in addition to the Cyber Security Law and Data Security Law. Drafts of some of these laws, regulations or measures have now been published, including the draft amendment to the Measures for Cyber Security Review published by Cyberspace Administration of China in July 2021 for public comments, which provides that, among others, an application for cyber security review shall be made by an issuer who is a CIIO or a "data processing operator" as defined therein before such issuer's securities become listed in a foreign country if the issuer possesses personal information of more than one million users, and that the relevant governmental authorities in the PRC may initiate cyber security review if such governmental authorities determine an operator's cyber products or services, data processing or potential listing in a foreign country affect or may affect national security.
The exact scope of CIIOs and important data under the current laws, regulations and regulatory regime remains unclear, and the authorities may have wide discretion in the interpretation and enforcement of the related laws and regulations. If we are deemed as a CIIO, or as an operator who collects, uses and processes important data according to the Cyber Security Law, Data Security Law and other relevant laws and regulations, we may need to perform or be subject to certain prescribed obligations, and if we were found to be in violation of these applicable laws and regulations, we may be subject to administrative penalties, including fines and service suspension. We also cannot rule out the possibility that certain of our customers may be deemed as CIIOs, or as operators processing important data, in which case our products or services or data processing activities, if being deemed as related to national security, will need to be submitted for cybersecurity review before we can enter into agreements with such customers, and before the conclusion of such procedure, the customers will not be allowed to use our products or services. If the reviewing authority considers that the use of our services by certain of our customers involves risk of disruption, is vulnerable to external attacks, or may negatively affect, compromise, or weaken the protection of national security, we may not be able to provide our products or services to such customers, which could have a material adverse effect on our results of operations and business prospects.