Company: ZK
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0001410578-25-000390
Chunk: 147

Company: ZEEKR Intelligent Technology Holding Ltd
Filing Date: 2025-03-20
Form: 20-F
Item: Item 4
Chunk 147
---
 and identify data based on the industry requirements, business needs, data sources and purposes and other factors, and to make a data classification list. In addition, the industrial and telecommunication data processors shall establish and improve a sound data classification management system, take measures to protect data based on the levels, carryout key protection of critical data, implement stricter management and protection of core data on the basis of critical data protection, and implement the protection with the highest level of requirement if different levels of data are processed at the same time. The Data Security Measures also impose certain obligations on industrial and telecommunication data processors in relation to, among others, implementation of data security work system, administration of key management, data collection, data storage, data usage, data transmission, provision of data, publicity of data, data destruction, safety audit and emergency plans, etc.

80

On December 28, 2021, the CAC, and several other administrations jointly promulgated the revised Cybersecurity Review Measures, which became effective on February 15, 2022 and supersede and replace the Cybersecurity Review Measures previously promulgated on April 13, 2020. The Cybersecurity Review Measures provide that (i) the purchase of network products and services by a CIIO and the data processing activities of a network platform operator that affects or may affect national security shall apply for a cybersecurity review, (ii) an application for cybersecurity review should be made by the internet platform operator holding personal information of more than one million users before such internet platform operator lists its securities in a foreign country, and (iii) the relevant PRC governmental authorities may initiate a cybersecurity review if they determine certain network products, services, or data processing activities affect or may affect national security. The Cybersecurity Review Measures further elaborate the factors to be considered when assessing the national security risks of the relevant activities, including among others, the risk of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or exited the country, or the risk of critical information infrastructure, core data, important data or a large amount of personal information being affected, controlled and maliciously used by overseas governments after being listed abroad.
On July 7, 2022, the CAC promulgated the Security Assessment Measures, which took effect on September 1, 2022. Pursuant to the Security Assessment Measures, a data processor shall apply to competent authorities for security assessment prior to transferring any data abroad if the transfer involves (i) important data;