Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 125

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 3
Chunk 125
---
 data classification, backups and encryption. The PRC Cybersecurity Law also imposes a relatively vague but broad obligation to provide technical support and assistance to the public and state security authorities in connection with criminal investigations or for reasons of national security. The PRC Cybersecurity Law also requires network operators that provide network access or domain name registration services, landline or mobile phone network access, or that provide users with information publication or instant messaging services, to require users to provide a real identity when they sign up. The PRC Cybersecurity Law sets high requirements for the operational security of facilities deemed to be part of the PRC’s “critical information infrastructure.” These requirements include data localization, i. e., storing personal information and important business data in China, and national security review requirements for any network products or services that may impact national security. Among other factors, “critical information infrastructure” is defined as critical information infrastructure, that will, in the event of destruction, loss of function or data leak, result in serious damage to national security, the national economy and people’s livelihoods, or the public interest. Specific reference is made to key sectors such as public communication and information services, energy, transportation, water-resources, finance, public services, and e-government.

The Provisions on Technological Measures for Internet Security Protection, promulgated by the Ministry of Public Security on December 13, 2005, becoming effective on March 1, 2006, require internet service providers to keep records of certain information about their users (including user registration information, log-in and log-out times, IP addresses, content and time of posts by users) for at least 60 days. Under the PRC Cybersecurity Law, network operators must report any instances of public dissemination of prohibited content. If a network operator fails to comply with these requirements, the PRC government may revoke its ICP License and shut down its websites.

Table of Contents

On March 13, 2019, the Office of the Central Cyberspace Affairs Commission and the SAMR jointly issued the Notice on App Security Certification and the Implementation Rules on Security Certification of Mobile Internet Application, which encourages mobile application operators to voluntarily obtain app security certification, and search engines and app stores are encouraged to recommend certified applications to users.

On July 22, 2020, the Ministry of Public Security published the Guiding Opinions on the Implementation of Cybersecurity Hierarchical Protection System and Critical Information Infrastructure Security Protection System, which require, among others, a scientific determination of the cybersecurity protection level based on the