Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 278

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 4
Chunk 278
---
 information transmitted overseas by a critical information infrastructure operator or a data processor that has processed personal data of more than one million persons, (iii) personal information transmitted overseas by a data processor who has already provided personal data of 100,000 persons or sensitive personal data of 10,000 persons overseas since January 1 of last year, or (iv) other circumstances as requested by the CAC. In addition, data processors are required to conduct self-assessment on the risks of cross-border data transmission prior to their applying for the security assessment and focus on assessment of the following significant matters, including, among others: (i) the legality and necessity of the purpose, scope, and method of cross-border data transmission, (ii) the scale, scope, type, and sensitivity of data transmitted overseas, and risks to the national security, public interests, or legitimate rights of individuals or organizations caused by such cross-border data transmission, (iii) the responsibilities and obligations that the overseas recipient of such data promises to undertake, and whether such overseas recipient’s management and technical measures and capabilities for performing its responsibilities and obligations can guarantee the security of cross-border data transmission, (iv) the risks that the data transmitted overseas may be falsified, destroyed, divulged, lost, transferred, illegally obtained, or illegally used during and after the cross-border transmission, and (v) whether contracts or other legally binding documents entered into with the overseas recipient have fully stipulated the responsibilities and obligations to protect data security. Furthermore, any cross-border data transmission activities conducted in violation of the Measures for the Security Assessment of Cross-Border Data Transmission before the effectiveness of the measures, which is September 1, 2022, are required to be rectified within six months of the effectiveness date.
On February 22, 2023, the CAC promulgated the Provisions on the Standard Contract for Personal Information Outbound Transfer, which became effective on June 1, 2023. The provisions state that the personal information processor who provides personal information abroad through execution of standard contract shall meet certain criteria, conduct an assessment on personal information protection impact before providing any personal information abroad, and complete the filing with local cybersecurity authority within ten working days from the effective date of the standard contract. The provisions attach a sample standard contract for personal information outbound transfer.
On March 22, 2024, the CAC promulgated the Provisions on Facilitating and Regulating Cross-border Data Flow, effective on the same date. The provisions require data processors to identify and declare