We receive, transmit and store personally identifiable information and other data on our platform, and we are subject to numerous laws and regulations that address privacy, data protection and the collection, storing, sharing, use, disclosure and protection of certain types of data in various jurisdictions.
The PRC government has proposed or promulgated a number of new measures and regulations in recent years regarding cybersecurity and data security, such as the Cybersecurity Law promulgated by the Standing Committee of the National People's Congress in November 2016, which came into effect in June 2017, the Data Security Law promulgated by the Standing Committee of the National People's Congress in June 2021, which came into effect in September 2021, the Personal Information Protection Law promulgated by the Standing Committee of the National People's Congress in August 2021, effective in November 2021. These regulatory developments impose more specific and comprehensive requirements with respect to data security and privacy protection. For more information about these PRC laws and regulations, see "Item 4. Information on the Company-B. Business Overview-Regulation-PRC Regulations-Regulations Relating to Cybersecurity and Information Security" and "Item 4. Information on the Company-B. Business Overview-Regulation-PRC Regulations-Regulations Relating to Privacy Protection."
On December 28, 2021, the CAC, together with certain other PRC governmental authorities, promulgated the Revised Cybersecurity Review Measures, which took effect from February 15, 2022. Pursuant to these measures, the purchase of network products and services by an operator of critical information infrastructure or the data processing activities of a network platform operator that affect or may affect national security will be subject to cybersecurity review. In addition, any online platform operator possessing over one million users' individual information must apply for a cybersecurity review before listing abroad. The competent governmental authorities may also initiate a cybersecurity review against an operator if the authorities believe that the network product or service or data processing activities of the operator affects or may affect national security. Article 10 of the Revised Cybersecurity Review Measures also set out certain national security risk factors to be considered and assessed under the cybersecurity review. See "Item 4. Information on the Company-B. Business Overview-Regulation-PRC Regulations-Regulations on Cybersecurity and Information Security." As of the date of this annual report, no regulator has promulgated any detailed implementation rules, the specific scope of "operators of critical information infrastructure" is subject to the discretion of the regulators and the specific rules regarding whether an activity "will or may affect national security" have not yet been promulgated. As such, how the Revised Cybersecurity Review Measures will be interpreted or implemented depends on the implementation rules to be promulgated by the regulators. If we fail to comply with these new regulatory requirements, we may be subject to new legal risks.
We intend to closely monitor regulatory developments and take any necessary measures in a timely manner to protect user privacy and data security. For example, after these new laws and regulations were promulgated, to ensure our compliance with them, we (i) enhanced the ability of our internal departments to protect information and maintain data security; (ii) supplemented and refined our policies for data security and personal information protection; (iii) enhanced our assessment and approval procedures for data processing activities, and created personal information protection assessments regarding processing of sensitive information; (iv) refined our mechanisms for responding to user rights requests to ensure a timely and adequate response; and (v) further enhanced our technical measures relating to data security.
On November 14, 2021, the CAC promulgated the draft Regulations on the Administration of Cyber Data Security for public comment, pursuant to which data processors conducting the following activities must apply for cybersecurity review: (i) a merger, reorganization or division of internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests affects or may affect national security; (ii) an overseas listing of a data processor that processes the personal information of more than one million users; (iii) a listing in Hong Kong that affects or may affect national security; or (iv) other data processing activities that affect or may affect national security. To date, these draft regulations have not yet become effective, but if they were promulgated in their current form, and if we are required to apply for a new cybersecurity review but are unable to complete that review, our business operations may be materially and adversely impacted.
In addition, the draft Regulations on the Administration of Cyber Data Security set out a full set of compliance requirements with respect to the processing of important data and impose regulatory requirements on the governance of internet platform operators' data. Since our mobility services may involve the collection and usage of important data, if this draft is finalized in its current form, we would need to enhance our internal data governance to comply with the compliance requirements. These laws, rules or regulations, together with the rules promulgated by the CSRC regarding overseas listing by PRC domestic companies, may further affect our business and any future securities offerings given factors such as our various networks, platforms, types of data collected, number of users, among others. See "Item 3. Key Information-D. Risk Factors-Risks Relating to Doing Business in China-We may be required to obtain approval or subject to filing or other requirements from the CSRC or other PRC governmental authorities for any future listing or other financing activities" for more details regarding the rules promulgated by the CSRC regarding overseas listing by PRC domestic companies.
In the meantime, the PRC regulatory authorities have also enhanced the supervision and regulation of cross-border data transfer. For example, the CAC promulgated the Measures for the Security Assessment of Cross-Border Data Transfer, which took effect on September 1, 2022. These measures require data processors providing data to overseas recipients to apply for a security assessment of cross-border data transfer by the national cybersecurity authority through its local counterpart under certain circumstances. The CAC also promulgated the Measures on the Standard Contract for Cross-border Transfer of Personal Information, which became effective on June 1, 2023. These measures require personal information processors providing personal information to overseas recipients by entering into standard contracts to file with the local counterpart of the CAC under certain circumstances. Furthermore, on March 22, 2024, the CAC promulgated the Provisions on Promoting and Standardizing Cross-Border Data Transfer, which further set forth the circumstances that are exempted from, and thresholds for, performing the security assessment or filing procedures for cross-border data transfer under these measures.
We have incurred, and will continue to incur, significant expenses in our efforts to comply with cybersecurity and information security standards and protocols imposed by law, regulation, industry standards or contractual obligations. Changes in existing laws or regulations or adoption of new laws and regulations relating to cybersecurity and information security, particularly any new or modified laws or regulations that require enhanced protection of certain types of data or new obligations with regard to data retention, transfer or disclosure, could greatly increase the cost to us of providing our service offerings, or require significant changes to our operations.
The regulatory authorities have the power, based on statutes and regulations, to carry out inspections or cybersecurity reviews of us. If any of our behavior has violated statutes or regulations, we may incur heavy fines or negative publicity, and we may need to change our business practices, which may increase our expenses and materially affect our business, prospects, financial condition and operational results. For example, in accordance with the requirements of the PRC Cybersecurity Law, a cyberspace operator or a cyberspace product or service provider which infringes upon the legal rights of individuals' personal information in violation of the provisions under the Cybersecurity Law may be ordered by a competent authority to make rectifications, and depending on the seriousness of the case, it may be subject to warnings, confiscation of illegal gains, and/or monetary fines. In serious cases, the competent authorities may require us to suspend operations, shut down our websites and apps or revoke our business permits and licenses.
We have undergone a cybersecurity review in China in the past. See "Item 8. Financial Information-A. Consolidated Statements and Other Financial Information-Legal and Administrative Proceedings" for more details. In addition, if in the future, we are subject to business restrictions resulting from new regulatory reviews, or if we violate any PRC statutes or regulations and incur any penalty or punishment, the growth or use of our platform in China may decline, which would have a material adverse effect on our business, financial condition, operations and prospects.
Despite our efforts to comply with applicable laws, regulations and other obligations relating to privacy, data protection and information security, we cannot assure you that our practices, offerings or platform meet all of the requirements imposed on us by such laws, regulations or obligations. Any failure on our part to comply with applicable laws or regulations or any other obligations relating to privacy, data protection or information security, or any compromise of security that results in unauthorized access, use or release of personally identifiable information or other data, or the perception or allegation that any of the foregoing types of failure or compromise has occurred, could damage our reputation, discourage new and existing drivers, riders and other users from using our platform or result in investigations, fines, suspension of one or more of our apps, or other penalties by government authorities and private claims or litigation, any of which could materially adversely affect our business, financial condition and results of operations. If there is a perception of privacy concerns, it may harm our reputation and brand and adversely affect our business, financial condition and results of operations.