Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 275

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 4
Chunk 275
---
 development interests of the state, and that the state shall establish a national security review and supervision system to review, among other things, foreign investment, key technologies, internet, and information technology products and services, and other important activities that are likely to impact the national security of the PRC.
On November 7, 2016, the Standing Committee of the National People’s Congress issued the PRC Cybersecurity Law, which came into effect on June 1, 2017. This is the first Chinese law that focuses exclusively on cybersecurity. The PRC Cybersecurity Law provides that network operators must set up internal security management systems that meet the requirements of a classified protection system for cybersecurity, including appointing dedicated cybersecurity personnel, taking technical measures to prevent computer viruses, network attacks and intrusions, taking technical measures to monitor and record network operation status and cybersecurity incidents, and taking data security measures such as data classification, backups and encryption. The PRC Cybersecurity Law also imposes a relatively vague but broad obligation to provide technical support and assistance to the public and state security authorities in connection with criminal investigations or for reasons of national security. The PRC Cybersecurity Law also requires network operators that provide network access or domain name registration services, landline or mobile phone network access, or that provide users with information publication or instant messaging services, to require users to provide a real identity when they sign up. The PRC Cybersecurity Law sets high requirements for the operational security of facilities deemed to be part of the PRC’s “critical information infrastructure.” These requirements include data localization, i.e., storing personal information and important business data in China, and national security review requirements for any network products or services that may impact national security. Among other factors, “critical information infrastructure” is defined as critical information infrastructure, that will, in the event of destruction, loss of function or data leak, result in serious damage to national security, the national economy and people’s livelihoods, or the public interest. Specific reference is made to key sectors such as public communication and information services, energy, transportation, water-resources, finance, public services, and e-government.
The Provisions on Technological Measures for Internet Security Protection, promulgated by the Ministry of Public Security on December 13, 2005, becoming effective on March 1, 2006, require internet service providers to keep records of certain information about their users (including user registration information, log-in and log-out times, IP addresses, content and time of posts by users) for at least 60