Company: FENG
Filing Date: 2025-04-18
Form Type: 20-F
Source: 0000950170-25-055759
Chunk: 67

Company: Phoenix New Media Ltd
Filing Date: 2025-04-18
Form: 20-F
Item: Item 4
Chunk 67
---
 risks are found. In the event of a data security incident, the processors of data shall take immediate measures to deal with it, inform the user in time and report to the competent authorities in accordance with relevant provisions. The processors of important data shall, in accordance with relevant provisions, carry out regular risk assessments of their data processing activities and submit risk assessment reports to the competent authorities. The PRC Data Security Law provides a national data security review system, under which data processing activities that affect or may affect national security shall be reviewed. Any organization or individual carrying out data processing activities that violates the PRC Data Security Law shall bear the corresponding civil, administrative or criminal liability depending on the specific circumstances.

On December 28, 2021, the CAC, NDRC, MIIT and other ten PRC regulatory authorities jointly issued the Cybersecurity Review Measures, effective on February 15, 2022. TheCybersecurity Review Measures require that, (i) any procurement of network products and services by critical information infrastructure operators, which affects or may affect national security, (ii) any data processing activities by network platform operators, which affects or may affect national security, or (iii) any network platform operators, which has personal information of more than one million users and is going to be listed abroad, shall be subject to cybersecurity review.

On July 30, 2021, the State Council issued theRegulations for the Security Protection of Critical Information Infrastructure(the “ CII Regulations”), which came into effect on 1 September 2021. Pursuant to the CII Regulations, “critical information infrastructures” refers to important network facilities and information systems of important industries and sectors such as public communications and information services, energy, transport, water conservation, finance, public services, e-government, and science and technology industry for national defense, as well as other important network facilities and information systems that may seriously endanger national security, national economy and citizen’s livelihood and public interests if they are damaged or suffer from malfunctions, or if any leakage of data in relation thereto occurs. Competent authorities as well as the supervision and administrative authorities of the above-mentioned important industries and sectors are responsible for the security protection of critical information infrastructures (the “ Protection Authorities”). The Protection Authorities will establish the rules for the identification of critical information infrastructures based on the particular situations of the industry and report such rules to the public security department of the State Council for record. The following factors must be considered when establishing identification rules: (i) the importance of network