Company: NOAH
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0001410578-25-000852
Chunk: 140

Company: NOAH HOLDINGS LTD
Filing Date: 2025-04-24
Form: 20-F
Item: Item 4
Chunk 140
---
 details the audit procedures—from the development of audit plans to the issuance of audit reports—to ensure enterprises adhere to standards when processing personal information.
Regulations Relating to Data Cross-border Transfer
On July 7, 2022, the CAC promulgated the Measures for the Security Assessment of Data Cross-border Transfer, or the Security Assessment Measures, which took effect on September 1, 2022 and requires that any data processor providing important data collected and generated during operations within the territory of mainland China or personal information that should be subject to security assessment according to law to an overseas recipient shall conduct security assessment. The Security Assessment Measures provides four circumstances, under any of which data processors shall, through the local cyberspace administration at the provincial level, apply to the national cyberspace administration for security assessment of data cross-border transfer. These circumstances include: (i) where the data to be transferred to an overseas recipient contain important data collected and generated by data processors; (ii) where the data to be transferred to an overseas recipient are personal information collected and generated by operators of critical information infrastructure or data processors processing over one million users’ individual information; (iii) where the personal information of more than 100,000 people or sensitive personal information of more than 10,000 people are transferred overseas accumulatively since January 1 of the previous year; or (iv) other circumstances under which security assessment of data cross-border transfer is required as prescribed by the national cyberspace administration.
On August 31, 2022, the CAC promulgated the first edition of the Guide to Applications for Security Assessment of Outbound Data Transfers, or the Security Assessment Guide. The Security Assessment Guide provides practical guidance to the implementation of the Security Assessment Measures. The Security Assessment Guide also reaffirms CAC’s position that a cross-border data transfer out of mainland China includes where a data processor stores data collected or generated in its operations in mainland China to an overseas recipient, and where a data processor allows an overseas entity, organization, or individual to access, retrieve, download, or export data the data processor collects or generates and stores in mainland China. 
On February 22, 2023, the CAC promulgated the Measures for Standard Contract for Outbound Data Transfer of Personal Information, or the Measures, which came into effect on June 1, 2023. The Measures provide a transitional period of six months from the effective date for companies to take necessary measures to comply with the requirements. According to the Measures, in