Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 280

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 4
Chunk 280
---
 Cross-border Data Flow, (i) for outbound data transfer activities with approved security assessment prior to the implementation of the provisions, the data processor may carry on such activities in accordance with its security assessment application, (ii) for outbound data transfer activities that failed or partially failed the security assessment prior to the implementation of the provisions yet are exempted from security assessment in accordance with the provisions, the data processor may conduct such activities by executing a standard contract for outbound transfer of personal information or passing the certification for personal information protection, and (iii) for outbound data transfer activities that applied for security assessment or submitted filing for standard contract for outbound transfer of personal information prior to the implementation of the provisions, yet are exempted from such procedures in accordance with the provisions, the data processor may proceed with its previous assessment or filing or withdraw its assessment or filing.
On September 24, 2024, the State Council published the Data Security Regulations, which became effective on January 1, 2025. The Data Security Regulations provide that data processors conducting the data processing activities that affect or may affect national security shall apply for cybersecurity review in accordance with the relevant laws and regulations. The Data Security Regulations subject network data processors to certain statutory obligations, including but not limited to: (i) network data processors shall, in accordance with the provisions of laws and administrative regulations and the mandatory requirements of national standards, and on the basis of classified protection of cyber security, strengthen the protection of network data security, establish and perfect the system of network data security management, and take technical measures such as encryption, backup, access control and security authentication as well as other necessary measures to protect network data from being falsified, destroyed, divulged or illegally acquired or used, dispose of network data security incidents, prevent illegal and criminal activities aiming at and using network data, and assume primary responsibility for the security of the network data processed by them; and (ii) data processors processing personal information of more than 10 million users shall specify the person in charge of network data security and the management body for network data security.
Regulations Relating to Internet Privacy
PRC government authorities enacted laws and regulations on internet use to protect personal information from any unauthorized disclosure. PRC law does not prohibit internet content provision operators from collecting and analyzing personal information from their users. However, the Administrative Measures on Internet Information Services prohibits an internet content provision operator from insulting or slandering a third party or infringing the lawful rights and interests of a third party.
The Several Provisions on Regulating the Market Order of