Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 22

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 3
Chunk 22
---
 regulations. See “ Item 4. Information on the Company - B. Business Overview - Regulations - Regulations Relating to Information Security.”

In addition, on June 10, 2021, the Standing Committee of the National People’s Congress promulgated the PRC Data Security Law, which took effect on September 1, 2021. The PRC Data Security Law provides for a data security review procedure for the data processing activities that affect or may affect national security. It also imposes data security obligations on persons and entities conducting data processing activities and requires data processors to take necessary measures to protect data security. On August 20, 2021, the Standing Committee of the National People’s Congress promulgated the PRC Personal Information Protection Law, which took effect on November 1, 2021. Although it is our policy to only access user information that is necessary for, and relevant to, the services provided and we update our privacy policies and practices in accordance with regulatory developments, we may be required to make further adjustments to our data practices as the PRC Personal Information Protection Law is newly promulgated and the interpretation of many of its specific requirements remain to be clarified by the government authorities or is otherwise subject to uncertainties.

The PRC government authorities also further enhanced the supervision and regulation of cross-border data transmission. On July 7, 2022, the CAC promulgated the Measures for the Security Assessment of Cross-Border Data Transmission, which took effect on September 1, 2022. In accordance with these measures, data processors are be subject to security assessment conducted by the CAC prior to any cross-border data transmission if the transmission involves (i) important data, (ii) personal information transmitted overseas by a critical information infrastructure operator or a data processor that has processed personal data of more than one million persons, (iii) personal information transmitted overseas by a data processor that has already provided personal data of 100,000 persons or sensitive personal data of 10,000 persons overseas since January 1 of the preceding year, or (iv) other circumstances as required by the CAC. In addition, any cross-border data transmission activities conducted in violation of the Measures for the Security Assessment of Cross-Border Data Transmission before the effectiveness of these measures are required to be rectified within six months of the effectiveness date thereof. Since these measures are relatively new, there are still substantial uncertainties with respect to the interpretation and implementation of these measures in practice and how they affect our business operation.

On March 22,