Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 127

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 3
Chunk 127
---
 that data processors conducting the following activities shall apply for cybersecurity review: (i) merger, reorganization or division of internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests affects or may affect national security; (ii) listing in a foreign country of data processors processing over one million users’ personal information; (iii) listing in Hong Kong which affects or may affect national security; or (iv) other data processing activities that affect or may affect national security. The CAC solicited comments until December 13, 2021, but there is no timetable for its enactment. On December 28, 2021, the CAC, the NDRC, the MIIT, and several other PRC governmental authorities jointly promulgated the Cybersecurity Review Measures, which took effect on February 15, 2022. According to the Cybersecurity Review Measures, critical information infrastructure operators that intend to purchase internet products and services and internet platform operators engaging in data processing activities that affect or may affect national security must be subject to the cybersecurity review, and an internet platform operator possessing personal information of over one million users and intending to be listed on a foreign stock exchange must be subject to the cybersecurity review.

Table of Contents

On July 7, 2022, the CAC promulgated the Measures for the Security Assessment of Cross-Border Data Transmission, which took effect on September 1, 2022. In accordance with these measures, data processors will be subject to security assessment conducted by the CAC prior to any cross-border data transmission if it involves (i) important data, (ii) personal information transmitted overseas by a critical information infrastructure operator or a data processor that has processed personal data of more than one million persons, (iii) personal information transmitted overseas by a data processor who has already provided personal data of 100,000 persons or sensitive personal data of 10,000 persons overseas since January 1 of last year, or (iv) other circumstances as requested by the CAC. In addition, data processors are required to conduct self-assessment on the risks of cross-border data transmission prior to their applying for the security assessment and focus on assessment of the following significant matters, including, among others: (i) the legality and necessity of the purpose, scope, and method of cross-border data transmission, (ii) the scale, scope, type, and sensitivity of data transmitted overseas, and risks to the national security, public interests, or legitimate rights of individuals or