Our business involves collecting and retaining large volumes of customer data, including personal information as our various information technology systems enter, process, summarize and report such data. We also maintain information about various aspects of our operations. The integrity and protection of our customer and company data is critical to our business. Our customers expect that we will adequately protect their personal information. We are required by applicable laws to keep strictly confidential the personal information that we collect, and to take adequate security measures to safeguard such information.
The PRC Criminal Law, as amended by its Amendment 7 (effective on February 28, 2009) and Amendment 9 (effective on November 1, 2015), prohibits any person from selling or providing a citizen's personal information obtained during the course of performing duties or providing services, or obtaining such information through theft or other illegal ways. On November 7, 2016, the SCNPC issued the Cyber Security Law of the PRC, or the Cyber Security Law, which became effective on June 1, 2017. Pursuant to the Cyber Security Law, network operators must not, without users' consent, collect their personal information, and may only collect users' personal information necessary to provide their services. Providers are also obliged to provide security maintenance for their products and services and shall comply with provisions regarding the protection of personal information as stipulated under the relevant laws and regulations. The Civil Code of the PRC (issued by the PRC National People's Congress on May 28, 2020 and effective from January 1, 2021) provides main legal basis for privacy and personal information infringement claims under the Chinese civil laws. PRC regulators, including the Cyberspace Administration of China, MIIT, and the Ministry of Public Security have been increasingly focusing on regulation in the areas of data security and data protection. The PRC regulatory requirements regarding cybersecurity are constantly evolving. For instance, various regulatory bodies in China, including the Cyberspace Administration of China, the Ministry of Public Security and State Administration for Market Regulation, or the SAMR, have enforced data privacy and protection laws and regulations with varying and evolving standards and interpretations. On November 14, 2021, the Cyberspace Administration of China, or the CAC, issued the Draft Cyber Data Security Regulations for public comments, pursuant to which, data processors carrying out the following activities must, in accordance with the relevant national regulations, apply for a cybersecurity review: (i) the merger, reorganization or spin-off of internet platform operators that possess a large number of data resources related to national security, economic development and public interests that affects or may affect national security; (ii) listing in a foreign country of data processors that process the personal information of more than one million users; (iii) listing in Hong Kong of data processors that affect or may affect national security; and (iv) other data processing activities that affect or may affect national security. The scope of and threshold for determining what "affects or may affect national security" is still subject to uncertainty and further elaboration by the CAC. On December 28, 2021, the CAC, and 12 other relevant PRC government authorities published the amended Cybersecurity Review Measures, which came into effect on February 15, 2022. The final Cybersecurity Review Measures provide that a "network platform operator" that possesses personal information of more than one million users and seeks a listing in a foreign country must apply for a cybersecurity review. Further, the relevant PRC governmental authorities may initiate a cybersecurity review against any company if they determine certain network products, services or data processing activities of such company affect or may affect national security. Through the contractual arrangements with Shanghai Weishi Information Technology Co., Ltd. ("Weishi"), Shanghai DayDayCook Information Technology Co., Ltd. ("DDC Shanghai") had collected and possessed personal information of more than one million users. After the contractual arrangements with Weishi were terminated in April 2022, DDC Shanghai still have been possessing this amount of personal information which are stored in mainland China. For purposes of the Cybersecurity Review Measures, we have applied for and completed the cybersecurity review with respect to our proposed overseas listing pursuant to the Cybersecurity Review Measures.
As there remains significant uncertainty in the interpretation and enforcement of relevant PRC cybersecurity laws and regulations, we cannot assure you that we would not become subject to enhanced cybersecurity review or investigations launched by PRC regulators in the future. Any failure or delay in the completion of the cybersecurity review procedures or any other non-compliance with the related laws and regulations may result in rectification, fines or other penalties, including suspension of business, website closure, removal of our app from the relevant app stores, and revocation of prerequisite licenses, as well as reputational damage or legal proceedings or actions against us, which may have material adverse effect on our business, financial condition or results of operations.
On June 10, 2021, the SCNPC promulgated the PRC Data Security Law, which took effect on September 1, 2021. The PRC Data Security Law imposes data security and privacy obligations on entities and individuals carrying out data activities, and introduces a data classification and hierarchical protection system based on the importance of data in economic and social development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, or illegally acquired or used. The PRC Data Security Law also provides for a national security review procedure for data activities that may affect national security and imposes export restrictions on certain data and information. As uncertainties remain regarding the interpretation and implementation of these laws and regulations, we cannot assure you that we will comply with such regulations in all respects and we may be ordered to rectify or terminate any actions that are deemed illegal by regulatory authorities. We may also become subject to fines and/or other sanctions which may have material adverse effect on our business, operations and financial condition.
On August 20, 2021, the SCNPC promulgated the PRC Personal Information Protection Law, or the PIPL, which took effect in November 2021. In addition to other rules and principles of personal information processing, the PIPL specifically provides rules for processing sensitive personal information. Sensitive personal information refers to personal information that, once leaked or illegally used, could easily lead to the infringement of human dignity or harm to the personal or property safety of an individual, including biometric recognition, religious belief, specific identity, medical and health, financial account, personal whereabouts and other information of an individual, as well as any personal information of a minor under the age of 14. Only where there is a specific purpose and sufficient necessity, and under circumstances where strict protection measures are taken, may personal information processors process sensitive personal information. A personal information processor shall inform the individual of the necessity of processing such sensitive personal information and the impact thereof on the individual's rights and interests apart from the matters of, including without limitation, name and contact number of the processor, processing purpose and method, type to be processed, preservation period of the information, means and procedures by which individuals exercise the rights provided by the PIPL. As uncertainties remain regarding the interpretation and implementation of the PIPL, we cannot assure you that we will comply with the PIPL in all respects and regulatory authorities may order us to rectify or terminate our current practice of collecting and processing sensitive personal information.
While we take various measures to comply with all applicable data privacy and protection laws and regulations, there is no guarantee that our current security measures and those of our third-party service providers may always be adequate for the protection of our customer or company data. Any failure, or perceived failure to maintain the security of our user data or to comply with applicable PRC or foreign privacy, data security and personal information protection laws and obligations may result in civil or regulatory liability, including governmental or data protection authority enforcement actions and investigations, fines, penalties, enforcement orders requiring us to cease operating in a certain way, litigation, or adverse publicity, and may require us to expend significant resources in responding to and defending allegations and claims, all of which may have material adverse effect on our business, operations and financial condition. In addition, compliance with applicable laws on data privacy requires substantial expenditure and resources, including to continually evaluate our policies and processes and adapt to new requirements that are or become applicable to us on a jurisdiction-by-jurisdiction basis, which would impose significant burdens and costs on our operations or may require us to alter our business practices.
In addition, we may be a particularly attractive target for computer hackers, foreign governments or cyber terrorists. Unauthorized access to our proprietary internal and customer data may be obtained through break-ins, sabotage, breach of our secure network by an unauthorized party, computer viruses, computer denial-of-service attacks, employee theft or misuse, breach of the security of the networks of our third-party service providers, or other misconduct. Because the techniques used by computer programmers who may attempt to penetrate and sabotage our proprietary internal and customer data change frequently and may not be recognized until launched against a target, we may be unable to anticipate these techniques. Unauthorized access to our proprietary internal and customer data may also be obtained through inadequate use of security controls. We may incur significant costs in protecting against cyberattacks, and if an actual or perceived breach of security occurs to our systems or a third party's systems, we could be required to expend significant resources to mitigate the breach of security and to address matters related to any such breach, including notifying users or regulators. Any of such incidents may also harm our reputation and adversely affect our business and results of operations. In addition, we may be subject to negative publicity about our security and privacy policies, systems, or measurements from time to time.
Any failure to prevent or mitigate security breaches, cyber-attacks or other unauthorized access to our systems or disclosure of our customers' data, including their personal information, could result in loss or misuse of such data, interruptions to our service system, diminished customer experience, loss of customer confidence and trust, impairment of our technology infrastructure, and harm our reputation.
As of the date of this annual report, on the basis that there exists no outstanding inquiry, notice, warning, or sanctions in relation to our data security and data protection, we believe we are in compliance of PRC laws and regulations in material aspects in relation to data security and data protection.
However, in anticipation of the strengthened implementation of cybersecurity laws and regulations and the continued expansion of our business, we face potential risks of being required to comply with higher cybersecurity standards. If we are not able to comply with the cybersecurity and data privacy requirements in a timely manner, or at all, we may be subject to government enforcement actions and investigations, rectification, fines, penalties, suspension of our non-compliant operations, or removal of our app from the relevant application stores, among other sanctions, which could materially and adversely affect our business and results of operations.