Regulatory authorities in China have implemented and are considering further legislative and regulatory proposals concerning data protection. China's new Data Security Law went into effect on September 1, 2021. The Data Security Law provides that the data processing activities must be conducted based on "data classification and hierarchical protection system" for the purpose of data protection and prohibits entities in China from transferring data stored in China to foreign law enforcement agencies or judicial authorities without prior approval by the Chinese government. The Data Security Law sets forth the legal liabilities of entities and individuals found to be in violation of their data protection obligations, including rectification order, warning, fines of up to RMB 5 million, suspension of relevant business, and revocation of business permits or licenses.
In addition, the PRC Cybersecurity Law provides that personal information and important data collected and generated by operators of critical information infrastructure during their operations in the PRC should be stored in the PRC, and the law imposes heightened regulation and additional security obligations on operators of critical information infrastructure. According to the Cybersecurity Review Measures promulgated by the Cyberspace Administration of China and certain other PRC regulatory authorities in April 2020, which became effective in June 2020, operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services which do or may affect national security. Any failure or delay in the completion of the cybersecurity review procedures may prevent the critical information infrastructure operator from using or providing certain network products and services and may result in fines of up to ten times the purchase price of such network products and services. The PRC government recently launched cybersecurity reviews against several mobile apps operated by several U.S.-listed Chinese companies and prohibited these apps from registering new users during the review periods. We do not believe that we constitute a critical information infrastructure operator under the Cybersecurity Review Measures that took effect in June 2020.
On July 10, 2021, the Cyberspace Administration of China (the "CAC") issued the Cybersecurity Review Measures (revised draft for public comments), which proposed to authorize the relevant government authorities to conduct cybersecurity review on a range of activities that affect or may affect national security. The PRC National Security Law covers various types of national security, including technology security and information security. The revised Cybersecurity Review Measures took effect on February 15, 2022. The revised Cybersecurity Review Measures expand the cybersecurity review to data processing operators in possession of personal information of over 1 million users if the operators intend to list their securities in a foreign country. Under the revised Cybersecurity Review Measures, the scope of entities required to undergo cybersecurity review to assess national security risks that arise from data processing activities would be expanded to include all critical information infrastructure operators who purchase network products and services and all data processors carrying out data processing activities that affect or may affect national security. In addition, such reviews would focus on the potential risk of core data, important data, or a large amount of personal information being stolen, leaked, destroyed, illegally used or exported out of China, or critical information infrastructure being affected, controlled or maliciously used by foreign governments after such a listing. An operator that violates these measures shall be dealt with in accordance with the provisions of the PRC Cybersecurity Law and the PRC Data Security Law. We believe that the cybersecurity review requirement under the revised Cybersecurity Review Measures for online platform operators in possession of personal information of over one million users going public in a foreign country does not apply to us or any of our PRC subsidiaries, because we are not an online platform operator, and we became a public company with shares listed on Nasdaq before such Measures entered into force on February 15, 2022. However, there remains uncertainty as to the interpretation and implementation of the revised Cybersecurity Review Measures and we cannot assure you that the CAC will reach the same conclusion as us. Besides, in accordance with the revised Cybersecurity Review Measures, if a member of the cybersecurity review working mechanism believes that a network product or service or data processing activity affects or may affect national security, the Office of Cybersecurity Review has the right to conduct cybersecurity review with the approval of the Office of the Central Cyberspace Affairs Commission. As of the date of this report, we have not received any investigations, notices, warnings, or sanctions from applicable governmental authorities in relation to national security. We also confirm that, as of the date of this report, we have not been involved in any investigation conducted by the CAC in connection with the cybersecurity review on national security or any other grounds, and have not received any inquiries, notices, warnings, or sanctions in this regard. However, there remains significant uncertainty as to the enactment, interpretation and implementation of regulatory requirements related to overseas securities offerings and other capital markets activities. If it is determined in the future that the approval of the CSRC, CAC or any other regulatory authority is required for any of our offerings, we may face sanctions by the CSRC, the CAC or other Chinese regulatory agencies. These regulatory agencies may impose fines and penalties on our subsidiaries' operations in China, limit our ability to pay dividends outside of China, limit our operations in China, delay or restrict the repatriation of the proceeds from overseas offerings into China or take other actions that could have a material adverse effect on our business, financial condition, results of operations and prospects, as well as the trading price of our ordinary shares. In addition, if the CSRC, the CAC or other regulatory agencies later promulgate new rules requiring that we obtain their approvals for any of our offerings, we may be unable to obtain a waiver of such approval requirements, when procedures are established to obtain such a waiver. Any uncertainties and/or negative publicity regarding such an approval requirement could have a material adverse effect on the trading price of our ordinary shares.
On November 14, 2021, the CAC released the Regulations on Network Data Security (draft for public comments) and accepted public comments until December 13, 2021. The draft Regulations on Network Data Security provide more detailed guidance on how to implement the general legal requirements under legislations such as the Cybersecurity Law, Data Security Law, and the Personal Information Protection Law. The draft Regulations on Network Data Security follow the principle that the state will regulate based on a data classification and multi-level protection scheme. We believe that we or any of our PRC subsidiaries do not constitute an online platform operator under the draft Regulations on Network Data Security as proposed, which is defined as a platform that provides information publishing, social network, online transaction, online payment, and online audio/video services.
On August 20, 2021, the Standing Committee of the National People's Congress of China promulgated the Personal Information Protection Law which became effective on November 1, 2021. The Personal Information Protection Law provides a comprehensive set of data privacy and protection requirements that apply to the processing of personal information and expands data protection compliance obligations to cover the processing of personal information of persons by organizations and individuals in China, and the processing of personal information of persons in China outside of China if such processing is for purposes of providing products and services to, or analyzing and evaluating the behavior of, persons in China. The Personal Information Protection Law also provides that critical information infrastructure operators and personal information processing entities who process personal information meeting a volume threshold to be set by Chinese cyberspace regulators are also required to store in China personal information generated or collected in China, and to pass a security assessment administered by Chinese cyberspace regulators for any export of such personal information. Lastly, the Personal Information Protection Law contains proposals for significant fines for serious violations of up to RMB 50 million or 5% of annual revenues from the prior year and may also be ordered to suspend any related activity by competent authorities. We have access to and may be required to collect certain information of our customers in providing services and which may cause the need of further adjustment on our business practice in order to comply with new regulatory requirements.
Interpretation, application and enforcement of these laws, rules and regulations evolve from time to time and their scope may continually change, through new legislation, amendments to existing legislation or changes in enforcement. Compliance with the PRC Cybersecurity Law and the PRC Data Security Law could significantly increase the cost to us of providing our service offerings, require significant changes to our operations or even prevent us from providing certain service offerings in jurisdictions in which we currently operate or in which we may operate in the future. Despite our efforts to comply with applicable laws, regulations and other obligations relating to privacy, data protection and information security, it is possible that our practices or service offerings could fail to meet all of the requirements imposed on us by the PRC Cybersecurity Law, the PRC Data Security Law and/or related implementing regulations. Any failure on our part to comply with such law or regulations or any other obligations relating to privacy, data protection or information security, or any compromise of security that results in unauthorized access, use or release of personally identifiable information or other data, or the perception or allegation that any of the foregoing types of failure or compromise has occurred, could damage our reputation, discourage new and existing counterparties from contracting with us or result in investigations, fines, suspension or other penalties by Chinese government authorities and private claims or litigation, any of which could materially adversely affect our business, financial condition and results of operations. Even if our practices are not subject to legal challenge, the perception of privacy concerns, whether or not valid, may harm our reputation and brand and adversely affect our business, financial condition and results of operations. Moreover, the legal uncertainty created by the Data Security Law and the recent Chinese government actions could materially adversely affect our ability, on favorable terms, to raise capital, including engaging in follow-on offerings of our securities in the U.S. market.