Company: LI
Filing Date: 2025-04-10
Form Type: 20-F
Source: 0001410578-25-000678
Chunk: 162

Company: Li Auto Inc.
Filing Date: 2025-04-10
Form: 20-F
Item: Item 4
Chunk 162
---
 important data should be stored within China, and if it is necessary to transfer such data abroad, it must undergo a security assessment organized by the regulator.

92

On July 7, 2022, the CAC issued the Measures for the Security Assessment of Cross-border Transfer of Data, which took effect on September 1, 2022. These measures require the data processor providing data overseas to apply for the security assessment of cross-border transfer of data with the local provincial-level counterparts of the national cybersecurity authority under any of the following circumstances: (i) where the data processor intends to provide important data overseas; (ii) where a critical information infrastructure operator and a data processor who has processed personal information of more than 1,000,000 individuals intends to provide personal information overseas; (iii) where a data processor who has provided personal information of 100,000 individuals or sensitive personal information of 10,000 individuals to overseas recipients, in each case as calculated cumulatively, since January 1 of the last year intends to provide personal information overseas; or (iv) other circumstances where the security assessment of data cross-border transfer is required as prescribed by the CAC. Furthermore, the data processor must conduct a self-assessment on the risk of data cross-border transfer prior to applying for the foregoing security assessment, under which the data processor must consider certain factors including, among other things, (i) the purpose, scope and manner of the cross-border data transfer and the overseas data recipient processing data and the legality, legitimacy and necessity thereof, (ii) the scale, scope, type and sensitivity of the transferred data, the risks to national security, public interests and the legitimate rights and interests of individuals or organizations arising from the cross-border data transfer, (iii) the overseas data recipient’s commitment to assume responsibility and obligations, the management and technical measures to fulfill the responsibilities and obligations, and the ability to ensure the security of the transferred data, (iv) the risk of data being tampered with, destroyed, leaked, lost, transferred, or illegally obtained or illegally used during and after the cross-border transfer, and the existence of channels for safeguarding the rights and interests of personal information, and (v) adequate compliance of data transfer-related contracts or other legally binding documents between the data processor and the overseas recipient with the data security protection responsibilities and obligations. The data processors that in violation of such measures are required to rectify such non-compliance within 6 months of the effectiveness date thereof.
On December 8, 2022