Our business involves collecting and retaining a large volume of internal and customer data, including credit card numbers and other personal information as our various information technology systems enter, process, summarize and report such data. We also maintain information about various aspects of our operations as well as our employees. The integrity and protection of our customer, employee and company data are critical to our business. Our customers and employees expect that we will adequately protect their personal information. We are required by applicable laws to keep strictly confidential the personal information that we collect, and to take adequate security measures to safeguard such information. Our security measures and those of our third-party service providers may not be adequate for the protection of our customers, employees or company data.
In addition, computer hackers, foreign governments or cyber terrorists may attempt to penetrate our network security and our website. Unauthorized access to our proprietary internal and customer data may be obtained through break-ins, sabotage, breach of our secure network by an unauthorized party, computer viruses, computer denial-of-service attacks, employee theft or misuse, breach of the security of the networks of our third-party service providers, or other misconduct. Because the techniques used by computer programmers who may attempt to penetrate and sabotage our proprietary internal and customer data change frequently and may not be recognized until launched against a target, we may be unable to anticipate these techniques. Unauthorized access to our proprietary internal and customer data may also be obtained through inadequate use of security controls. The laws and regulations applicable to security and privacy are becoming increasingly important in China. The theft, loss, fraudulent or unlawful use of customer, employee or company data could harm our reputation or result in remedial and other costs, liabilities, fines or lawsuits.
The Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, known as the general data protection regulation, or GDPR, has imposed certain requirements on the processing of personal data relating to natural persons. GDPR requirements will apply both to companies established in the EU and to companies, such as us, that are not established in the EU but process personal data of individuals who are in the EU (and in the European Economic Area subject to the enactment of implementation procedures), where the processing activities relate to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the EU; or (b) the monitoring of their behavior as far as their behavior takes place within the EU. Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business, and the failure to comply with the GDPR could expose us to sanctions from both a financial and business operations perspective. In addition, in case of control, noncompliance with the GDPR may expose us to damage to our reputation.
On February 1, 2013, China's initial personal data protection guidelines, the Guidelines for Personal Information Protection in Information Security Technology Public and Commercial Service Systems, became effective, which guidelines set forth detailed requirements as to the protection of personal information and data collection, data processing, data transfer and data creation. Although these guidelines are voluntary and non-binding, we are advised by our PRC counsel that, going forward, further regulatory oversight of data privacy in China is expected. In addition, Amendment 7 to the PRC Criminal Law prohibits institutions, companies and their employees in the telecommunications and other industries from selling or otherwise illegally disclosing a PRC citizen's personal information obtained during the course of performing their duties or providing services, or obtaining such information through theft or other illegal means. On November 7, 2016, the Standing Committee of the PRC National People's Congress issued the Cybersecurity Law of the PRC, which became effective on June 1, 2017. On August 20, 2021, the Standing Committee of the PRC National People's Congress issued the Personal Information Protection Law of the PRC, which became effective on November 11, 2021. Pursuant to such law, providers of network products and services shall maintain the security of their products and services and shall comply with provisions regarding the protection of personal information as stipulated under relevant laws and regulations. Moreover, the Provisions on Protection of Personal Information of Telecommunication and Internet Users specifically regulates the collection, use, disclosure and security of personal information. Complying with these PRC laws and regulations may cause us to incur substantial costs or require us to change our business practices.
While we take various measures to comply with all applicable data privacy and protection laws and regulations of the PRC, our current security measures and those of our third-party service providers may not be adequate for the protection of our customers, employees or company data. In addition, hackers, foreign governments or cyber terrorists may attempt to penetrate our network security and our website. Unauthorized access to our proprietary internal and customer data may be obtained through break-ins, sabotage, breach of our secure network by an unauthorized party, computer viruses, computer denial-of-service attacks, employee theft or misuse, breach of the secure networks of our third-party service providers, or other misconduct. Because the techniques used in any attempt to penetrate and sabotage our proprietary internal and customer data change frequently and may not be recognized until launched against us, we may be unable to anticipate or protect against these techniques. Unauthorized access to our proprietary internal and customer data may also be obtained through inadequate security measures. Laws and regulations in China relating to security and privacy are becoming increasingly important. Any theft, loss, fraudulent, unlawful use or disclosure of customer, employee or company data could harm our reputation and result in remedial and other costs, liabilities, fines or lawsuits.