Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 23

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 3
Chunk 23
---
2024, the CAC promulgated the Provisions on Facilitating and Regulating Cross-border Data Flow, effective on the same date. The provisions intend to replace the rules set forth in the Measures for the Security Assessment of Cross-Border Data Transmission that are inconsistent with the new provisions. Pursuant to the Provisions on Facilitating and Regulating Cross-border Data Flow, a data processor intending to implement outbound data transfer under the following circumstances shall apply for security assessment to the CAC: (i) a critical information infrastructure operator intending to provide personal information or important data abroad; or (ii) a data processor that is not a critical information infrastructure operator intending to provide important data abroad, or has since January 1st of the current year cumulatively provided personal information (excluding sensitive personal information) of over one million individuals, or sensitive personal information of over 10,000 individuals, abroad. For any data processors other than critical information infrastructure operators who have since January 1st of the current year cumulatively provided personal information (excluding sensitive personal information) of over 100,000 and less than one million individuals, or sensitive personal information of less than 10,000 individuals abroad, should execute a standard contract for outbound transfer of personal information with the recipient abroad or pass the certification for personal information protection.

On September 24, 2024, the State Council published the Network Data Security Management (the “Data Security Regulations”), which became effective on January 1, 2025. The Data Security Regulations provide that data processors conducting the data processing activities that affect or may affect national security shall apply for cybersecurity review in accordance with the relevant laws and regulations. The Data Security Regulations subject network data processors to certain statutory obligations, including but not limited to: (i) network data processors shall, in accordance with the provisions of laws and administrative regulations and the mandatory requirements of national standards, and on the basis of classified protection of cyber security, strengthen the protection of network data security, establish and perfect the system of network data security management, and take technical measures such as encryption, backup, access control and security authentication as well as other necessary measures to protect network data from being falsified, destroyed, divulged or illegally acquired or used, dispose of network data security incidents, prevent illegal and criminal activities aiming at and using network data, and assume primary responsibility for the security of the network data processed by them; and (ii) data processors processing personal information of more than 10 million users shall specify the person in charge of network data security