Company: NOAH
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0001410578-25-000852
Chunk: 32

Company: NOAH HOLDINGS LTD
Filing Date: 2025-04-24
Form: 20-F
Item: Item 3
Chunk 32
---
 in connection with our future issuance of securities overseas, and, if required, we cannot predict whether or for how long we will be able to obtain such approval or complete such filing”, “—Any failure to ensure cybersecurity or protection of our clients’ personal data or privacy could lead to legal liabilities, adversely affect our reputation and have a material adverse effect on our business, financial condition or results of operations” and “—Our business is subject to various evolving laws and regulations of mainland China regarding data privacy and cybersecurity. Failure of cybersecurity and data privacy concerns could subject us to penalties, damage our reputation and brand, and harm our business and results of operations.” It is uncertain whether or how these new laws, rules and regulations and the interpretation and implementation thereof may affect us, but among other things, our ability to obtain external financing through the issuance of equity securities overseas could be negatively affected.

24

Our business is subject to various evolving laws and regulations of mainland China regarding data privacy and cybersecurity. Failure of cybersecurity and data privacy concerns could subject us to penalties, damage our reputation and brand, and harm our business and results of operations.
We face significant challenges with respect to cybersecurity and data privacy, including the receipt, processing, storage, and transmission of the data of our clients and others, much of which is confidential. We are subject to various regulatory requirements relating to cybersecurity and data privacy, including, without limitation the PRC Cybersecurity Law. The Cybersecurity Law requires, among others, a network operator to adopt technical measures and other necessary measures to safeguard the safety and stability of network operations, effectively respond to network security incidents, prevent illegal and criminal activities, and maintain the integrity, confidentiality and availability of network data. The Cybersecurity Law also reaffirms certain basic principles and requirements on personal information protection. 
Regulatory requirements on cybersecurity and data privacy are constantly evolving and can be subject to varying interpretations, resulting in uncertainties about the scope of our responsibilities in that regard. For example, on June 10, 2021, the Standing Committee of the National People’s Congress promulgated the PRC Data Security Law, which took effect on September 1, 2021. The Data Security Law applies to data processing activities, including the collection, storage, use, processing, transmission, availability and disclosure of data, and security supervision of such activities within the territory of mainland China. According to the Data Security Law, whoever carries out data processing activities shall establish a sound data security management system throughout the whole process, organize data security education and training, and take corresponding