Company: ZK
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0001410578-25-000390
Chunk: 145

Company: ZEEKR Intelligent Technology Holding Ltd
Filing Date: 2025-03-20
Form: 20-F
Item: Item 4
Chunk 145
---
 economic and social development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, or illegally acquired or used, provides for a national security review procedure for those data activities which may affect national security and imposes export restrictions on certain data and information. The PRC Data Security Law provides that “data” refers to any recording of information by electronic or other means. Data processing includes the collection, storage, use, processing, transmission, availability and disclosure of data, etc.
On August 12, 2021, the MIIT issued the Access Administration Opinion, which provided responsibilities of intelligent connected vehicles manufacturing enterprises, and required such enterprises to strengthen the management of vehicle data security, cybersecurity, software updates, function safety and intended function safety. Furthermore, the Access Administration Opinion stated that vehicles manufacturing enterprises shall conduct security assessment prior to transmitting data abroad.

79

On July 30, 2021, the State Council promulgated the Regulations on SCII, which took effect in September 2021. The Regulations on SCII supplement and specify the provisions on the security of critical information infrastructure as stated in the Cybersecurity Review Measures. The Regulations on SCII provide, that “critical information infrastructures” shall mean any important network facilities or information systems of important industries or fields such as public communication and information service, energy, communications, water conservation, finance, public services, e-government affairs and national defense science, and any other important network facilities or information systems which may endanger national security, people’s livelihood and public interest in case of damage, function loss or data leakage. In addition, relevant administration departments of each critical industry and sector, or Protection Departments, shall be responsible to formulate eligibility criteria and determine the CIIOs in the respective industry or field. The operators shall be informed about the final determination as to whether they are categorized as CIIOs. The regulations further require CIIOs, among others, (i) to report to the competent Protection Departments in a timely manner when the identification result may be affected due to material changes in the critical information infrastructures; (ii) to plan, construct or put into use the security protection measures and the critical information infrastructures simultaneously; and (iii) to report to the competent Protection Departments in a timely manner in the event of merger, division or dissolution, and deal with critical information infrastructures as required by the competent Protection Departments. Operators in violation of the regulations may be ordered