We receive and maintain certain personal, financial and other information about our customers in various information systems that we maintain and in those maintained by third-party service providers. Our information technology systems, such as those we use for administrative functions, including human resources, payroll, accounting and internal and external communications, can contain personal, financial or other information of our employees. We also maintain important proprietary and other confidential information related to our operations. As a result, we face risks inherent in handling and protecting information.
If our security and information systems or the security and information systems of third-party service providers are compromised for any reason, including as a result of data corruption or loss, security breach, cyber-attack or other external or internal methods, or if our employees, or service providers fail to comply with laws, regulations and practice standards, and this information is obtained by unauthorized persons, used or disclosed inappropriately or destroyed, it could subject us to litigation and government enforcement actions, cause us to incur substantial costs, liabilities and penalties and/or result in a loss of customer confidence, any and all of which could adversely affect our business, reputation, ability to attract new customers, results of operations and financial condition.
In addition, our business may be subject to PRC laws relating to the collection, use, sharing, retention, security, and transfer of confidential and private information, such as personal information and other data. These laws continue to develop, and the PRC government may adopt other rules and restrictions in the future. Non-compliance could result in penalties or other significant legal liabilities.
Pursuant to the PRC Cybersecurity Law, which was promulgated by the Standing Committee of the National People's Congress on November 7, 2016 and took effect on June 1, 2017, personal information and important data collected and generated by a critical information infrastructure operator in the course of its operations in China must be stored in China, and if a critical information infrastructure operator purchases internet products and services that affects or may affect national security, it should be subject to cybersecurity review by the Cyberspace Administration of China ("CAC"). Due to the lack of further interpretations, the exact scope of "critical information infrastructure operator" remains unclear.
On April 13, 2020, twelve Chinese government agencies jointly promulgated the Measures for Cybersecurity Review (2020 version) ("Old Measures"), which became effective on June 1, 2020, set forth the cybersecurity review mechanism for critical information infrastructure operators, and provided that critical information infrastructure operators ("CIIOs") who intend to procure network products and services that affect or may affect national security shall be subject to a cybersecurity review. On June 10, 2021, the Standing Committee of the National People's Congress promulgated the PRC Data Security Law, which took effect in September 2021. The Data Security Law provides for a security review procedure for the data activities that may affect national security. Moreover, the CAC issued the Measures of Cybersecurity Review (Revised Draft for Comments) on July 10, 2021, which requires operators with personal information of more than one million users who want to list abroad to file a cybersecurity review with the CAC. Furthermore, the General Office of the Central Committee of the Communist Party of China and the General Office of the State Council jointly issued the Opinions on Severe and Lawful Crackdown on Illegal Securities Activities, which was available to the public on July 6, 2021. These opinions emphasized the need to strengthen the administration over illegal securities activities and the supervision on overseas listings by China-based companies. These opinions proposed to take effective measures, such as promoting the construction of relevant regulatory systems, to deal with the risks and incidents facing China-based overseas-listed companies and the demand for cybersecurity and data privacy protection.
The Data Security Law also sets forth the data security protection obligations for entities and individuals handling personal data, including that no entity or individual may acquire such data by stealing or other illegal means, and the collection and use of such data should not exceed the necessary limits The costs of compliance with, and other burdens imposed by, PRC Cybersecurity Law and any other cybersecurity and related laws may limit the use and adoption of our products and services and could have an adverse impact on our business. Further, if the enacted version of the Measures for Cybersecurity Review mandates clearance of cybersecurity review and other specific actions to be completed by companies like us, we face uncertainties as to whether such clearance can be timely obtained, or at all.
On January 4, 2022, the CAC issued the revised Measures on Cyberspace Security Review (the "Revised Measures") that has come into effect on February 15, 2022, which required that, among others, in addition to "operator of critical information infrastructure," any "network platform operator data processor" controlling personal information of no less than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review. We do not believe we are among the "operator of critical information infrastructure" or "network platform operator data processor" who control over one million personal information as mentioned above; however, the definition of "network platform operator" is unclear. The revised draft of the Measures for Cybersecurity Review is in the process of being formulated and it is also unclear on how it will be interpreted, amended and implemented by the relevant PRC governmental authorities. The Revised Measures also establish a Cybersecurity Review Office (the "CRO"), an administrative body within the CAC, to formulate the regulations for cybersecurity review and to lead the cybersecurity review process. Applicable CIIOs and NP operators are required to submit an application to the CRO, and the CRO will assess whether a cybersecurity review is required.
As these laws, opinions and the measures were recently issued, official guidance and interpretation of these remain unclear in several respects at this time, and the PRC government authorities may have wide discretion in the interpretation and enforcement of these laws, opinions and the measures. Therefore, it is uncertain whether the future regulatory changes would impose additional restrictions on our business.
We believe that we are currently not be subject to the cybersecurity review by the CAC, given the factors discussed above. However, there remains uncertainty as to how the Revised Measures will be interpreted or implemented and whether the PRC regulatory agencies, including the CAC, may adopt new laws, regulations, rules, or detailed implementation and interpretation related to the Revised Measures. If any such new laws, regulations, rules, or implementation and interpretation come into effect, we will take all reasonable measures and actions to comply and to minimize the adverse effect of such laws on us.
We cannot assure you that PRC regulatory agencies, including the CAC, would take the same view as we do. In the event that we are subject to any mandatory cybersecurity review and other specific actions required by the CAC, we face uncertainty as to whether any clearance or other required actions can be timely completed, or at all. Given such uncertainty, we may be further required to suspend our relevant business, or face other penalties, which could materially and adversely affect our business, financial condition, and results of operations.