Company: LI
Filing Date: 2025-04-10
Form Type: 20-F
Source: 0001410578-25-000678
Chunk: 164

Company: Li Auto Inc.
Filing Date: 2025-04-10
Form: 20-F
Item: Item 4
Chunk 164
---
 Provisions provide certain exemptions, including, among others, (i) where cross-border transfer of personal information is necessary for the execution or performance of a contract to which the individual is a party, and (ii) where data processors, other than CIIOs, transfer personal information (excluding sensitive personal information) of fewer than 100,000 individuals abroad in aggregate as of January 1 of the current year. Under these exemptions, such transfers are not subject to obligations typically required for cross-border data transfers, such as undergoing a data security assessment, signing a standard contract for the provision of personal information abroad, or obtaining certification for personal information protection. In addition, pursuant to the Cross-border Data Transfer Provisions, the personal information covered by these exemptions must not include important data. Any important data that is subject to a data security assessment for cross-border transfers will be designated and publicly announced by the relevant authorities or regions.

93

On May 10, 2024, the MIIT issued the Implementing Rules for the Risk Assessment of Data Security in the Field of Industry and Information Technology (Trial Implementation), which came into effect on June 1, 2024. These rules apply to data processing activities carried out by processors of important and core data within the industrial and information technology sectors in the PRC, specifically for the purpose of conducting data security risk assessments. Processors of such data are required to conduct assessments in line with the principles of timeliness, objectivity, and effectiveness, and to produce assessment reports that are truthful, complete, and accurate, for which they are held accountable. In addition, processors must conduct at least one data security risk assessment per year, with the results of the assessment remaining valid for one year.
On September 24, 2024, the State Council published the Administration Regulations on Network Data Security, or the Data Security Regulations, which became effective on January 1, 2025. The Data Security Regulations provides that network data processors conduct network data processing activities that affects or may possibly affect national security must conduct national security review in accordance with relevant laws and regulations. It also imposes specific requirements for network data processors that process important data. The Data Security Regulations define “important data” as “data in specific fields, specific groups, specific regions or reaching certain accuracy and scale, which if tampered with, destroyed, leaked or illegally obtained or used may directly endanger national security, economic operation, social stability, public health and safety.” The Data Security Regulations calls for the national data security coordination mechanism to coordinate with relevant authorities