Company: NOAH
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0001410578-25-000852
Chunk: 135

Company: NOAH HOLDINGS LTD
Filing Date: 2025-04-24
Form: 20-F
Item: Item 4
Chunk 135
---
 sector-specific risks and regional factors, mandates enhanced protections for generative AI training datasets, and refines cross-border data transfer rules by adding exemptions for scenarios like fulfilling legal obligations. Notably, it establishes a tiered supervision framework where provincial authorities verify important data classifications, and mandates real-time reporting of security incidents involving national interests within 24 hours, and data processors shall, in accordance with relevant state provisions, apply for national security review when carrying out data processing activities that affect or may affect national security.
On February 27, 2023, CSRC promulgated the Measures for the Administration of Cybersecurity and Information Security in the Securities and Futures Industries, or the Securities and Futures Cybersecurity Measures, which became effective on May 1, 2023. The Securities and Futures Cybersecurity Measures shall apply to the construction, operation, maintenance and use of Internet and information systems by securities companies, futures companies, fund management companies and other securities and futures operating institutions in mainland China, putting forward detailed requirements regarding investors’ personal information protection and operation, promotion, development and emergency response of Internet and information security.
On December 27, 2024, the NFRA promulgated the Measures for Data Security Management of Banks and Insurance Institutions, which apply to all banks, insurance institutions, financial asset management companies, enterprise group finance companies, financial leasing companies, auto finance companies, consumer finance companies, currency brokerage companies, trust companies, and wealth management companies that are established within PRC, implements data classification and tiered management, enhances lifecycle controls requiring security assessments, anonymization, and operational log retention for sensitive data, reaffirms authorization and consent principles for personal information protection including explicit consent for intra-group data sharing, and establishes a dual regulatory mechanism requiring pre-reporting of sensitive data transfers, annual risk assessments, and mandatory reporting of security incidents within two hours.

85

Regulations Relating to Internet Privacy
In recent years, PRC government authorities have enacted laws and regulations on Internet use to protect personal information from any unauthorized disclosure. The Administrative Measures on Internet Information Services prohibit internet content provider, or ICP, service operators from insulting or slandering a third party or infringing upon the lawful rights and interests of a third party. Under the Several Provisions on Regulating the Market Order of Internet Information Services, issued by the MIIT on December 29, 2011, an ICP service operator may not collect any user’s personal information or provide any such information to third parties without the consent of the user. An ICP service operator must expressly