Company: FENG
Filing Date: 2025-04-18
Form Type: 20-F
Source: 0000950170-25-055759
Chunk: 68

Company: Phoenix New Media Ltd
Filing Date: 2025-04-18
Form: 20-F
Item: Item 4
Chunk 68
---
 facilities and information systems to the core businesses of the industry and the sector; (ii) the harm that may be brought by the damage, malfunction or data leakage of, the network facilities and information systems; and (iii) the associated impact on other industries and sectors. The Protection Authorities are responsible for organizing the identification of critical information infrastructures in their own industries and sectors in accordance with the identification rules, promptly notifying

the operators of the identification results and reporting to the public security department of the State Council.

On September 24, 2024, theRegulations on Network Data Security Management, or the Data Security Regulations, were issued by the State Council, which took effect on January 1, 2025. The Data Security Regulations reiterate and refine the general regulations for cyber data processing activities and rules of personal information protection, important data security protection, cyber data cross-border transfer security management, and the responsibilities of online platform service providers. In particular, the Data Security Regulations provide that cyber data processors whose cyber data processing activities affect or may affect national security shall be subject to national security review in accordance with the relevant regulations. Moreover, the Data Security Regulations provide certain obligations of the processors of important data, such as conducting risk assessment and reporting to the competent authorities for their network data handling activities on an annual basis.

On July 7, 2022, the CAC promulgated theMeasures for the Security Assessment of Data Cross-border Transfer, which took effect on September 1, 2022. TheMeasures for the Security Assessment of Data Cross-border Transfer requires the data processor providing data overseas and falling under any of the following circumstances to apply for the security assessment of cross-border data transfer by the national cybersecurity authority through its local counterpart: (i) where the data processor intends to provide important data overseas; (ii) where the critical information infrastructure operator and any data processor who has processed personal information of more than 1,000,000 individuals intend to provide personal information overseas; (iii) where any data processor who has provided personal information of 100,000 individuals or sensitive personal information of 10,000 individuals to overseas recipients accumulatively since January 1 of the last year intends to provide personal information overseas; and (iv) other circumstances where the security assessment of data cross-border transfer is required as prescribed by the CAC. Furthermore, the data processor shall conduct a self-assessment on the risk of data cross-border transfer prior to applying for the foregoing security assessment, under which the data processor shall focus on certain