Company: NOAH
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0001410578-25-000852
Chunk: 139

Company: NOAH HOLDINGS LTD
Filing Date: 2025-04-24
Form: 20-F
Item: Item 4
Chunk 139
---
 to the number prescribed by the national cyberspace administration shall store personal information collected and generated within mainland China. If it is really necessary to provide such personal information overseas, they shall pass the security assessment organized by the national cyberspace administration, except as otherwise stipulated by laws, administrative regulations and the national cyberspace administration. Any processor in violation of this law may be subject to administrative penalties including rectifications, warnings, fines, confiscation of illegal gains, suspension of the apps illegally processing personal information or suspension of the relevant business, revocation of business operation permits or business licenses, civil liabilities or even criminal liabilities. The directly responsible personnel in charge and other directly responsible personnel may be imposed with fines and prohibited from serving as directors, supervisors, senior management personnel and personal information protection officers of related companies within a certain period of time.
In addition, the Regulations on the Administration of Cyber Data Security also provides for key regulations in personal information and privacy protection. It explicitly prohibits network data processors from obtaining user consent through misleading, fraudulent, or coercive means, requires separate consent for processing sensitive personal information, and for the first time categorizes minors’ data as sensitive. It also introduces right to data portability, allowing users to request platforms to transfer their data under technically feasible conditions, and strengthen oversight of automated decision-making by prohibiting algorithms from imposing unreasonable differential treatment on transaction price. Furthermore, the Provisions on Promoting and Regulating Cross-border Data Flows optimizes data export mechanisms by exempting data outside Free Trade Zone negative lists from security assessments and raising the threshold for non-sensitive personal data exports from 100,000 to 1 million individuals. These updates establish a more refined compliance framework on Internet Privacy protection, achieving breakthroughs in scenario-based exemptions, enhanced cross-border flow efficiency, and strengthened platform accountability.

87

On February 12, 2025, the Cyberspace Administration of China issued the Administrative Measures for Personal Information Protection Compliance Audits, which will take effect on May 1, 2025. The Administrative Measures for Personal Information Protection Compliance Audits stipulates that personal information processors conducting compliance audits for personal information protection on their own initiative must perform such audits periodically, either through internal departments or by engaging third-party professional agencies, to assess their compliance with laws and administrative regulations in their personal information processing activities. It specifies the audit scope, including whether the collection, storage, use, and sharing of personal information comply with legal and regulatory requirements, defines audit methods such as document review, on-site inspection, and technical testing, and