Company: LI
Filing Date: 2025-04-10
Form Type: 20-F
Source: 0001410578-25-000678
Chunk: 50

Company: Li Auto Inc.
Filing Date: 2025-04-10
Form: 20-F
Item: Item 3
Chunk 50
---
 Protection.” We are required by these laws and regulations to ensure the confidentiality, integrity, availability, and authenticity of the information of our users and distributors, which is also essential to maintaining their confidence in our vehicles and services. We have adopted strict information security policies and deployed advanced measures to implement the policies, including, among others, advanced encryption technologies. However, advances in technology, an increased level of sophistication and diversity of our products and services, an increased level of expertise of hackers, new discoveries in the field of cryptography or others can still result in a compromise or breach of our websites, the Li Auto App, or our vehicles’ electronic systems. If we are unable to protect our systems, and hence the information stored in our systems, from unauthorized access, use, disclosure, disruption, modification, or destruction, such problems or security breaches could cause a loss, give rise to our liabilities to the owners of confidential information, or subject us to fines and other penalties. In addition, complying with various laws and regulations could cause us to incur substantial costs or require us to change our business practices, including our data practices, in a manner adverse to our business.
Regulatory requirements on cybersecurity and data privacy are constantly evolving and can be subject to varying interpretations or significant changes, resulting in uncertainties about the scope of our responsibilities in that regard. For example, on August 20, 2021, the Standing Committee of the National People’s Congress promulgated the PRC Personal Information Protection Law, which took effect on November 1, 2021. The PRC Personal Information Protection Law requires, among others, that (i) the processing of personal information should have a clear and reasonable purpose and should be directly related to its purpose, in a method that has the least impact on personal rights and interests, and (ii) the collection of personal information should be limited to the minimum scope necessary to achieve the processing purpose to avoid the excessive collection of personal information. Entities processing personal information must be responsible for their personal information processing activities and adopt necessary measures to safeguard the security of the personal information that they process. Otherwise, the entities processing personal information could be ordered to rectify, or suspend or terminate the provision of services, and face confiscation of illegal income, fines, or other penalties. On June 10, 2021, the Standing Committee of the National People’s Congress promulgated the PRC Data Security Law, which took effect on September 1, 2021. The PRC Data Security Law, among other things, provides for a