Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 279

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 4
Chunk 279
---
 important data in accordance with the regulations, and provide that, unless the competent departments or areas so notify or publicly release certain data as important data, the data processors do not need to apply for security assessment for outbound important data transfer for such data. The provisions set forth various circumstances exempted from application for security assessment for outbound data transfer, execution of a standard contract for personal information outbound transfer and passing of the certification for personal information protection. To the extent in compliance with the national data classification and hierarchical protection system framework, the provisions allow the pilot free trade zones to promulgate their own negative list of data requiring application for security assessment for outbound data transfer, execution of a standard contract for personal information outbound transfer or passing of the certification for personal information. The provisions further provide for, subject to exemptions set forth therein and negative lists of pilot free trade zones, circumstances requiring application for security assessment for outbound data transfer, execution of a standard contract for personal information outbound transfer or passing of the certification for personal information protection. A data processor intending to implement outbound data transfer under the following circumstances should apply for security assessment to the CAC: (i) a critical information infrastructure operator intending to provide personal information or important data abroad; or (ii) a data processor that is not a critical information infrastructure operator intending to provide important data abroad, or has since January 1st of the current year cumulatively provided personal information (excluding sensitive personal information) of over one million individuals, or sensitive personal information of over 10,000 individuals, abroad. For any data processors other than the critical information infrastructure operators who have since January 1st of the current year cumulatively provided personal information (excluding sensitive personal information) of over 100,000 and less than one million individuals, or sensitive personal information of less than 10,000 individuals abroad, should execute a standard contract for outbound transfer of personal information with the recipient abroad or pass the certification for personal information protection. The approval for security assessment for outbound data transfer is valid for three years and may be applied for extension if the data processors need to carry on its outbound data transfer activities and there occurs no circumstance requiring re-application for security assessment for outbound data transfer. To the extent that any provision set forth in the Measures for the Security Assessment of Cross-Border Data Transmission and Provisions on the Standard Contract for Personal Information Outbound Transfer is inconsistent with the provisions set forth in the provisions, the provisions prevail.

81

According to the official answers to press questions relating to the Provisions on Facilitating and Regulating