Company: LI
Filing Date: 2025-04-10
Form Type: 20-F
Source: 0001410578-25-000678
Chunk: 163

Company: Li Auto Inc.
Filing Date: 2025-04-10
Form: 20-F
Item: Item 4
Chunk 163
---
, the MIIT issued the Measures for the Administration of Data Security in the Field of Industry and Information Technology (for Trial Implementation), which took effect on January 1, 2023. The measures are aimed to regulate the processing activities of data in the field of industry and information technology field conducted by data processors in China. The measures apply to industrial enterprises, software and information technology service companies, and companies holding licenses for operation of telecommunication services that independently determine the purposes and methods of data processing in the course of data processing activities. Data processing activities include, among others, the collection, storage, use, processing, transmission, provision, and disclosure of data. Pursuant to the measures, data in the field of industry and information technology includes industrial data, telecommunication data, and radio data generated and collected during the operation of the services. The measures provide for the classification of data in the field of industry and information technology as general, important, or core data, and provide specific requirements for the management of data classifications and data protection measures, including, among other things, data collection, storage, processing, transmission, disclosure, and destruction for data processors in the field of industry and information technology. In particular, data processors processing important data and core data are required to complete filing with the authorities for the catalogue of important data and core data. The filing information includes basic information on the data, such as category, classification, quantity, processing purposes and methods of data processing, scope of use, liable entities, data sharing, cross-border transfer of data, and data security protection measures. If over 30% of the quantity (i.e. number of data items or amount of data stored) of important and core data changes or there is any material change to other filing information, data processors must update the filing information with the authorities within three months after such change. Furthermore, the measures provide data security requirements for cross-border and data transfers for data processors. If a data processor needs to transfer data in cases of merger, restructuring, or bankruptcy, it must make data transfer plan and notify users affected. In addition, the measures indicate that the legal representative or principal of the data processor should be the primary person held accountable for data security and the person in charge of data security should take direct responsibility for the security of data processing activities.
On March 22, 2024, the CAC issued the Provisions on Promoting and Regulating Cross-border Data Transfer, or the Cross-border Data Transfer Provisions, which took effect immediately. The Cross-border Data Transfer