Company: NOAH
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0001410578-25-000852
Chunk: 137

Company: NOAH HOLDINGS LTD
Filing Date: 2025-04-24
Form: 20-F
Item: Item 4
Chunk 137
---
 Method of Illegal Collection and Use of Personal Information Through App, which provides guidance for the regulatory authorities to identify the illegal collection and use of personal information through mobile apps, and for the app operators to conduct self-examination and self-correction and for other participants to voluntarily monitor compliance. On February 13, 2020, the People’s Bank of China issued Personal Financial Information Protection Technical Specification, which sets forth the security protection requirements, including the security technology requirements and security management requirements, for the collection, transmission, storage, use, deletion, destroying and other aspects of the personal financial information. In addition, the State Administration for Market Regulation and Standardization Administration issued the Standard of Information Security Technology-Personal Information Security Specification (2020 edition), which took effect on October 1, 2020. Pursuant to the standard, any entity or person who has the authority or right to determine the purposes for and methods of using or processing personal information are seen as a personal information controller. Such personal information controller is required to collect information in accordance with applicable laws, and except in certain specific events that are expressly exempted in the standard, to obtain the information provider’s consent prior to collection of such data.
Pursuant to the Civil Code of the PRC which came into effect on January 1, 2021, the personal information of a natural person shall be protected by the law. Any organization or individual that needs to obtain personal information of others shall obtain such information legally and ensure the safety of such information, and shall not illegally collect, use, process or transmit personal information of others, or illegally purchase or sell, provide or make public personal information of others.

86

On August 20, 2021, the Standing Committee of the National People’s Congress promulgated the PRC Personal Information Protection Law, which became effective on November 1, 2021. Pursuant to the PRC Personal Information Protection Law, personal information refers to the information related to an identified or identifiable individual recorded electronically or by other means, excluding the anonymized information, and processing of personal information includes among others, the collection, storage, use, handling, transmission, provision, disclosure, deletion of personal information. The PRC Personal Information Protection Law explicitly sets forth the circumstances where it is allowed to process personal information, including (i) the consent from the individual has been obtained; (ii) it is necessary for the conclusion and performance of a contract under which an individual is a party, or it is necessary for human resource management in accordance