Company: NOAH
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0001410578-25-000852
Chunk: 134

Company: NOAH HOLDINGS LTD
Filing Date: 2025-04-24
Form: 20-F
Item: Item 4
Chunk 134
---
 other obligations, complying with a series of requirements of tiered cyber protection systems, verifying users’ real identities, localizing the personal information and important data gathered and produced by key information infrastructure operators during operations within mainland China and providing assistance and support to government authorities where necessary for protecting national security and investigating crimes.

84

On September 14, 2022, the CAC published a draft amendment to the Cyber Security Law for public comment, or the Draft Amendment, which was formulated to align the Cyber Security Law with several new laws that were released after the Cyber Security Law came into effect in June 2017, including the Administrative Punishment Law, the Data Security Law, and the Personal Information Protection Law, all of which were adopted or amended in 2021. The Draft Amendment mainly proposes revisions on legal responsibility to adjust the types and ranges of administrative penalties for violating the Cyber Security Law and to align them with other laws. Generally, the fines and penalties to be imposed by Chinese cyberspace regulators have been significantly increased and expanded.
On December 28, 2021, the CAC, together with certain other PRC governmental authorities, jointly released the Revised Cybersecurity Review Measures, which took effect on February 15, 2022. Pursuant to the Revised Cybersecurity Review Measures, operators of critical information infrastructure that intend to purchase network products and services, or online platform operators that conduct data processing activities, that affect or may affect national security must apply for a cybersecurity review. In addition, any online platform operator holding over one million users’ individual information must apply for a cybersecurity review before listing abroad. The cybersecurity review will evaluate, among others, the risk of critical information infrastructure, core data, important data, or the risk of a large amount of personal information being influenced, controlled or maliciously used by foreign governments after going public, and cyber information security risk. The Revised Cybersecurity Review Measures set out certain general factors which would be the focus in assessing the national security risk during a cybersecurity review. However, the scope of network product or service or data processing activities that will or may affect national security is still unclear, and the PRC government authorities may have wide discretion in the interpretation and enforcement of these laws, rules and regulations.
Furthermore, on September 24, 2024, the PRC State Council promulgated the Regulations on the Administration of Cyber Data Security, which took effect on January 1, 2025. The Regulations on the Administration of Cyber Data Security introduces dynamic criteria for defining “important data” based on