Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 277

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 4
Chunk 277
---
-border data flow and confidential information management, and proposed to revise the provisions on strengthening confidentiality and archive administration of overseas issuance and listing of securities, to consolidate responsibility for information security of overseas listed companies, and to strengthen the standardized management of the cross-border information provision mechanism and process.
On July 30, 2021, the State Council promulgated the Regulations for the Security Protection of Critical Information Infrastructure, which became effective on September 1, 2021, defining “critical information infrastructures” as important network facilities and information systems in important industries including public communications and information services, as well as those that may seriously endanger national security, national economy, people’s livelihood, or public interests in the event of damage, loss of function, or data leakage. On November 14, 2021, the CAC published a draft of the Administrative Regulations for Internet Data Security, providing that data processors conducting the following activities shall apply for cybersecurity review: (i) merger, reorganization or division of internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests affects or may affect national security; (ii) listing in a foreign country of data processors processing over one million users’ personal information; (iii) listing in Hong Kong which affects or may affect national security; or (iv) other data processing activities that affect or may affect national security. The CAC solicited comments until December 13, 2021, but there is no timetable for its enactment. On December 28, 2021, the CAC, the NDRC, the MIIT, and several other PRC governmental authorities jointly promulgated the Cybersecurity Review Measures, which took effect on February 15, 2022. According to the Cybersecurity Review Measures, critical information infrastructure operators that intend to purchase internet products and services and internet platform operators engaging in data processing activities that affect or may affect national security must be subject to the cybersecurity review, and an internet platform operator possessing personal information of over one million users and intending to be listed on a foreign stock exchange must be subject to the cybersecurity review.
​

80

On July 7, 2022, the CAC promulgated the Measures for the Security Assessment of Cross-Border Data Transmission, which took effect on September 1, 2022. In accordance with these measures, data processors will be subject to security assessment conducted by the CAC prior to any cross-border data transmission if it involves (i) important data, (ii) personal