Company: NOAH
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0001410578-25-000852
Chunk: 33

Company: NOAH HOLDINGS LTD
Filing Date: 2025-04-24
Form: 20-F
Item: Item 3
Chunk 33
---
 technical measures and other necessary measures to ensure data security. The Data Security Law provides a national data security review system, under which data processing activities that affect or may affect national security shall be reviewed, and prohibits any individual or entity in mainland China from providing data stored in mainland China to foreign judicial or law enforcement departments without the approval of competent PRC authorities. In Addition, the Personal Information Protection Law of the PRC, issued on August 20, 2021 by the Standing Committee of the National People’s Congress, further details the general rules and principles on personal information processing and further increases the potential liability of personal information processor. Even though we have already taken necessary organizational and technical measures in accordance with applicable legal requirements to protect the safety of our network facilities and the data processed by us, we may still face risks inherent in handling and protecting large volumes of data, including protecting the data temporarily hosted in our system, detecting and prohibiting unauthorized data sharing and transfers, preventing attacks on our system by outside parties, foiling any fraudulent behavior or improper use by our employees, and maintaining and updating our database. Any system failure, security breach or attempts by third parties to illegally obtain the data that results in any actual or perceived release of client data could damage our reputation and brand, deter current and potential clients from using our services, affect our business and results of operations, and expose us to potential legal liability. 
On December 28, 2021, Measures for Cybersecurity Review was issued by the CAC jointly with other governmental authorities, which took effect on February 15, 2022. Under the Measures for Cybersecurity Review, the procurement of network products and services by critical information infrastructure operators and the data processing activities conducted by network platform operators which affect or may affect national security shall be subject to cybersecurity review. Besides, according to the Article 7 of the Measures for Cybersecurity Review, a network platform operator who processes the personal information of more than one million users and is seeking for listing in a foreign country must apply for a cybersecurity review. In addition, according to Article 16 of the Measures for Cybersecurity Review, member organizations of the cybersecurity review working mechanism may initiate cybersecurity review towards network products, network services, and data processing activities ex officio, which means we may be also subject to cybersecurity review when such member organizations initiate such cybersecurity review ex officio. 

25

Based on Measures for Cybersecurity Review, cybersecurity review shall focus on the assessment of a number of national security risk factors of the relevant object or situation, including but not limited