Company: NOAH
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0001410578-25-000852
Chunk: 34

Company: NOAH HOLDINGS LTD
Filing Date: 2025-04-24
Form: 20-F
Item: Item 3
Chunk 34
---
 to, risks of any illegal control or supply chain interruption of critical information infrastructure, and risks of illegal use or cross-border transmission of data. As advised by our mainland China legal counsel, Zhong Lun Law Firm, we should not be deemed as an operator of critical information infrastructure and the network products and services purchased and used by us are general network products and services in the market, and there is no obvious risk of supply chain interruption. We have not received any material queries or notifications from the CAC or other PRC governmental authorities and have not been subject to any material administrative penalties or other sanctions by any competent regulatory authorities in relation to cybersecurity, data and personal information protection. There has been no material cybersecurity or data protection incidents with respect to data or personal information theft, leakage, damage or loss. Our data will be transferred to recipients located in regions and countries outside the territory of mainland China, such as Hong Kong and the United States. However, since we process less than one million users’ personal information and transmit an insignificant number of users’ personal information to overseas recipients, the possibility for us to apply to the CAC for cybersecurity review is relatively low. Besides, we have taken necessary technical and organizational measures to protect the security of the data being transferred abroad, including using data encryption to secure personal information when it is in transit. We have also established a basic cybersecurity and data protection system pursuant to the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law and other relevant laws and regulations.
On September 24, 2024, the PRC State Council promulgated the Regulations on the Administration of Cyber Data Security, or the Cyber Data Security Regulations, which took effect on January 1, 2025. According to the Cyber Data Security Regulations, data processors shall, in accordance with relevant state provisions, apply for national security review when carrying out data processing activities that affect or may affect national security. Substantial uncertainties exist with respect to the interpretation and implementation, and we cannot assure that relevant governmental authorities will not interpret the laws and regulations in ways that may negatively affect us. 
There are uncertainties as to the interpretation and application of these cybersecurity laws, regulations and standards, which laws may be interpreted and applied in a manner that is inconsistent with our current policies and practices or require changes to the features of our system. If we are unable to address any data security and information protection concerns, any compromise of security that results unauthorized disclosure or transfer of personal data, or to comply with the then applicable laws and regulations, we may incur additional