Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 24

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 3
Chunk 24
---
 and the management body for network data security.

Table of Contents

While we take measures to comply with all applicable cybersecurity and data privacy laws and regulations, we cannot assure you the effectiveness of the measures undertaken by us and our business partners. The activities of third parties, such as merchants, brands, and other business partners are beyond our control. If any of these third parties violate the PRC Cybersecurity Law and related laws and regulations, or fail to fully comply with the service agreements with us, or if any of our employees fails to comply with our control measures and misuses the information, we may be subject to regulatory actions, disputes and litigations. Any actual or perceived failure to comply with all applicable cybersecurity and data privacy laws and regulations, or any actual or perceived failure of our business partners to do so, or any actual or perceived failure of our employees to comply with our internal control measures, may result in legal proceedings or regulatory actions against us, and could damage our reputation, discourage current and potential users and business partners from using our services and subject us to claims, fines, and damages, which could materially and adversely affect our business and results of operations.

New laws or regulations concerning data protection, or the interpretation and implementation of existing data security and privacy protection laws or regulations may be announced, published for public consultations, issued, or promulgated from time to time. For example, on December 28, 2021, several PRC government authorities jointly issued the Cybersecurity Review Measures, which took effect on February 15, 2022. Pursuant to the Cybersecurity Review Measures, critical information infrastructure operators that intend to purchase internet products and services and internet platform operators engaging in data processing activities that affect or may affect national security must be subject to the cybersecurity review. The Cybersecurity Review Measures further stipulate that if an internet platform operator has personal information of over one million users and pursues a foreign listing, it must be subject to the cybersecurity review. Given that the Cybersecurity Review Measures was recently promulgated, there are substantial uncertainties as to its interpretation, application, and enforcement.

Furthermore, the PRC government authorities have taken steps to limit the method and manner that the internet companies may apply when using the algorithms. For instance, the CAC, together with eight other government authorities, jointly issued the Guidelines on Strengthening the Comprehensive Regulation of Algorithms for Internet Information Services on September 17, 2021, which provide that daily monitoring of data use, application scenarios, and effects of algorithms must be carried out by