Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 129

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 3
Chunk 129
---
 for outbound data transfer, execution of a standard contract for personal information outbound transfer or passing of the certification for personal information protection. A data processor intending to implement outbound data transfer under the following circumstances should apply for security assessment to the CAC: (i) a critical information infrastructure operator intending to provide personal information or important data abroad; or (ii) a data processor that is not a critical information infrastructure operator intending to provide important data abroad, or has since January 1st of the current year cumulatively provided personal information (excluding sensitive personal information) of over one million individuals, or sensitive personal information of over 10,000 individuals, abroad. For any data processors other than the critical information infrastructure operators who have since January 1st of the current year cumulatively provided personal information (excluding sensitive personal information) of over 100,000 and less than one million individuals, or sensitive personal information of less than 10,000 individuals abroad, should execute a standard contract for outbound transfer of personal information with the recipient abroad or pass the certification for personal information protection. The approval for security assessment for outbound data transfer is valid for three years and may be applied for extension if the data processors need to carry on its outbound data transfer activities and there occurs no circumstance requiring re-application for security assessment for outbound data transfer. To the extent that any provision set forth in the Measures for the Security Assessment of Cross-Border Data Transmission and Provisions on the Standard Contract for Personal Information Outbound Transfer is inconsistent with the provisions set forth in the provisions, the provisions prevail.

Table of Contents

According to the official answers to press questions relating to the Provisions on Facilitating and Regulating Cross-border Data Flow, (i) for outbound data transfer activities with approved security assessment prior to the implementation of the provisions, the data processor may carry on such activities in accordance with its security assessment application, (ii) for outbound data transfer activities that failed or partially failed the security assessment prior to the implementation of the provisions yet are exempted from security assessment in accordance with the provisions, the data processor may conduct such activities by executing a standard contract for outbound transfer of personal information or passing the certification for personal information protection, and (iii) for outbound data transfer activities that applied for security assessment or submitted filing for standard contract for outbound transfer of personal information prior to the implementation of the provisions, yet are exempted from such procedures in accordance with the provisions, the data processor may proceed with its previous assessment or filing or withdraw its assessment or filing.

On September 24,