Our platform stores and processes certain personal and other sensitive data provided by insurance clients, and we make certain personal information provided by clients or third-party data providers available to insurer partners with user consent. There are numerous laws regarding privacy and the storing, sharing, use, disclosure and protection of personally identifiable information and data. Specifically, personally identifiable and other confidential information is increasingly subject to legislation and regulations in PRC and numerous foreign jurisdictions. PRC government authorities have enacted a series of laws and regulations relating to the protection of privacy and personal information, including, without limitation, the PRC Cybersecurity Law and the PRC Data Security Law, under which internet service providers and other network operators are required to clearly indicate the purposes, methods and scope of any information collection and usage, to obtain appropriate user consent and to establish user information protection systems with appropriate remedial measures. However, this regulatory framework for privacy issues in China and worldwide is currently evolving and is likely to remain uncertain for the foreseeable future.
Since 2021, the PRC government authorities have promulgated a series of laws and regulations to build a system for cybersecurity review. Pursuant to the Cybersecurity Review, which was promulgated by the CAC and 12 other governmental authorities in December 2021 an became effective on February 15, 2022, critical information infrastructure operators that procure internet products and services, as well as network platform operators engaging in data processing activities, must be subject to a cybersecurity review if their activities affect or may affect national security. As of the date of this annual report, no detailed rules or implementation has been issued by any authority. On November 14, 2021, the CAC released the Regulations on the Network Data Security (Draft for Comments), which were open for public comments until December 13, 2021. Network Data Security (Draft for Comments) provide that data processors shall apply for a cybersecurity review for activities such as merger, reorganization or division, listing abroad of data processors which process over one million users' personal information, the listing of data processors in Hong Kong which affects or may affect national security, and other data processing activities that affect or may affect national security. As of the date of this annual report, the Regulations on the Network Data Security (Draft for Comments) have been released for public comment only, and the provisions and the anticipated adoption or effective date are subject to substantial uncertainty. See "Item 4.B. Information on the Company-Business Overview-Regulations-Regulations on Internet-Regulations on Information Security" for more details. Furthermore, the definition of "affects or may affect national security" has not been clarified by any PRC regulatory authorities, and the PRC government authorities may have wide discretion in the interpretation and enforcement of these laws. Due to the lack of further clarifications or detailed rules and regulations, there are still uncertainties as to how the aforementioned rules will be interpreted or implemented, and it is unclear as to whether and to what extent listed companies like us will be subject to these requirements. As of the date of this annual report, we have not been informed as a critical information infrastructure operator by any government authorities, and we have not been involved in any formal investigations on cybersecurity review made by the CAC. However, if we are subject to a cybersecurity review, or if the PRC regulatory agencies later promulgate new rules or interpretations that subject us to their approvals, we may be unable to obtain a waiver for such requirements, and we may face penalties for failure to obtain or delay in obtaining approvals. If we are required to comply with these requirements but fail to do so in a timely manner, or at all, our business operation, financial conditions and business prospect, as well as the trading price of the ADSs, may be materially and adversely affected.
On August 20, 2021, the Standing Committee of the National People's Congress of China promulgated the Personal Information Protection Law, which integrates the scattered rules with respect to personal information rights and privacy protection and took effect on November 1, 2021. After obtaining consent from users, we collect user personal information that is necessary to provide the corresponding services. We do not use any sensitive personal information that is not related to the corresponding services in any manner that is not compliant with applicable laws and regulations. We update our privacy policies from time to time to meet the latest regulatory requirements of the CAC and other authorities and adopt technical measures to protect data and ensure cybersecurity. Nonetheless, the Personal Information Protection Law raises the protection requirements for processing personal information, and many specific requirements of the Personal Information Protection Law remain to be clarified by the CAC, other regulatory authorities, and courts in practice. We may be required to make further adjustments to our business practices to comply with the personal information protection laws and regulations. See "Item 4. Information on the Company-B. Business Overview-Regulations- Regulations on Internet-Regulations on Information Security."
The PRC Cyber Security Law, the PRC Data Security Law, the Personal Information Protection Law and other related laws and regulations as mentioned above are relatively new and subject to interpretation by the regulators. Although we only gain access to user information that is necessary for, and relevant to, the services provided, the data we obtain and use may include information that is deemed as "personal information," "network data" or "important data" under the data privacy and protection laws and regulations. As such, we have adopted a series of measures to ensure that we comply with the laws and regulations in the collection, use, disclosure, sharing, storage, and security of user information and other data. The Data Security Law also introduces a data classification and hierarchical protection system based on the importance of data in economic and social development, and the degree of harm it may cause to national security, public interests, or legitimate rights and interests of individuals or organizations if such data are tampered with, destroyed, leaked, illegally acquired or illegally used. See "Item 4. Information on the Company-B. Business Overview-Regulations-Regulations on Internet-Regulations on Information Security." The exact scopes of important data and state core data remain unclear and may be subject to further interpretation. If any data that we are in possession of constitutes important data or state core data, we may be required to adopt stricter measures for protection and management of such data.
In addition, we may need to comply with increasingly complex and rigorous regulatory standards enacted to protect business and personal data in Hong Kong, the U.S., Europe and elsewhere. For example, the European Union adopted the General Data Protection Regulation, or the GDPR, which became effective on May 25, 2018. The GDPR imposes additional obligations on companies regarding the handling of personal data and provides certain individual privacy rights to persons whose data is stored. Compliance with existing, proposed and recently enacted laws (including implementation of the privacy and process enhancements called for under GDPR) and regulations can be costly; any failure to comply with these regulatory standards could subject us to legal and reputational risks.
We generally comply with industry standards and are subject to the terms of our own privacy policies. Compliance with any additional laws could be expensive, and may place restrictions on the conduct of our business and the manner in which we interact with our customers. Any failure to comply with applicable regulations could also result in regulatory enforcement actions against us, and misuse of or failure to secure personal information could also result in violation of data privacy laws and regulations, proceedings against us by governmental authorities or other authorities, damage to our reputation and credibility and could have a negative impact on revenues and profits.
Significant capital and other resources may be required to protect against information security breaches or to alleviate problems caused by such breaches or to comply with our privacy policies or privacy-related legal obligations. The resources required may increase over time as the methods used by hackers and others engaged in online criminal activities are increasingly sophisticated and constantly evolving. Any failure or perceived failure by us to prevent information security breaches or to comply with privacy policies or privacy-related legal obligations, or any compromise of security that results in the unauthorized release or transfer of personally identifiable information or other customer data, could cause our customers to lose trust in us and could expose us to legal claims. Any perception by the public that online transactions or the privacy of user information are becoming increasingly unsafe or vulnerable to attacks could inhibit the growth of online retail and other online services generally, which may reduce the number of orders we receive.
We cannot assure you that our existing privacy and personal protection system and technical measures will be considered sufficient under applicable laws and regulations. We could be adversely affected if legislation or regulations in China are expanded to require changes in business practices or privacy policies, or if the PRC governmental authorities interpret or implement their legislation or regulations in ways that negatively affect our business, financial condition and results of operations. In addition to laws, regulations and other applicable rules regarding privacy and privacy advocacy, industry groups or other private parties may propose new and different privacy standards. Because the interpretation and application of privacy and data protection laws and privacy standards are still uncertain, it is possible that these laws or privacy standards may be interpreted and applied in a manner that is inconsistent with our practices. Any inability to adequately address privacy concerns, even if unfounded, or to comply with applicable privacy or data protection laws, regulations and privacy standards, could result in additional cost and liability for us, damage our reputation, inhibit the use of our platform and harm our business.