Company: FENG
Filing Date: 2025-04-18
Form Type: 20-F
Source: 0000950170-25-055759
Chunk: 69

Company: Phoenix New Media Ltd
Filing Date: 2025-04-18
Form: 20-F
Item: Item 4
Chunk 69
---
 factors including, among others, the legitimacy, fairness and necessity of the purpose, scope and method of data cross-border transfer and the data processing of overseas recipients, the risks that the cross-border data transfer may bring to national security, public interests and the legitimate rights and interests of individuals or organizations as well as whether the cross-border data transfer related contracts or the other legally binding documents to be entered with overseas recipients have fully included the data security protection responsibilities and obligations. On March 22, 2024, the CAC, issued the Guidelines for Declaring Data Cross-border Security Assessment (Second Edition), which further clarifies the scope of application, declaration methods and processes of data cross-border security assessment. On February 24, 2023, the CAC promulgated theMeasures for Standard Contracts for Cross-border Transfers of Personal Information, together with a template of such standard contract as an annex to the Measures, which took effect on June 1, 2023. Pursuant to the Measures, a personal information processor may enter into the Standard Contract and provide it along with the personal information protection impact assessment report to relevant governmental authorities for filing to ensure the legality of a cross-border transfer of personal information outside the territory of PRC if the following conditions are satisfied: the personal information processor (i) is not a critical information infrastructure operator; (ii) processes personal information of less than one million individuals; (iii) has provided personal information of less than 100,000 individuals overseas in aggregate since January 1 of the preceding year; and (iv) has provided sensitive personal information of less than 10,000 individuals overseas in aggregate since January 1 of the preceding year. For the outbound transfer of personal information that has already happened before the Measures takes effect, if it is found that any such transfer is not in compliance with the Measures, rectification shall be completed within six months upon the effective date of the Measures. Failure to complete such rectification within the prescribed period may result in penalties imposed by the competent governmental authorities. On March 22, 2024, the CAC promulgated theProvisions on Promoting and Regulating Cross-border Data Flows, which further clarify the implementation rules of existing systems to facilitate the cross-border flow of data, including, among others, relaxing the conditions for the cross-border transfer of data and narrowing the scope of security assessment on the cross-border transfer of data.

To comply with these laws and regulations, we have completed the mandatory security filing procedures with the local public security authorities, and