Company: ZK
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0001410578-25-000390
Chunk: 75

Company: ZEEKR Intelligent Technology Holding Ltd
Filing Date: 2025-03-20
Form: 20-F
Item: Item 3
Chunk 75
---
 and adversely affected. See “Item 4. Information on the Company—4.B. Business Overview—Regulation—The M&A Rules.”
Complying with evolving laws and regulations regarding cybersecurity, information security, privacy and data protection and other related laws and requirements may entail significant expenses and force us to make adverse changes to our business.
Laws and regulations governing cybersecurity, information security, privacy and data protection, the use of the internet as a commercial medium, the use of data in artificial intelligence and machine learning, and data sovereignty requirements are rapidly evolving, extensive, complex, and include uncertainties.

42

Laws and regulations regarding cybersecurity and information security
According to the PRC National Security Law, the State shall establish institutions and mechanisms for national security review and regulation, conduct national security review on certain matters which affect or may affect the national security, such as key technologies and IT products and services. According to the PRC Cybersecurity Law and relevant regulations, network constructors, network operators and service providers that provide services via network are obligated to take technical and other necessary measures to ensure the security and stable operation of network, maintain the integrity, confidentiality and availability of network data, and furthermore provide technical assistance and support in accordance with the law for public security and national security authorities to protect national security or assist with criminal investigations. In addition, the PRC Cybersecurity Law provides that personal information and important data collected and generated by operators of critical information infrastructure in the course of their operations in the PRC should be stored in the PRC, and the law imposes heightened regulation and additional security obligations on operators of critical information infrastructure. On September 12, 2022, the CAC proposed a series of draft amendments to the PRC Cybersecurity Law, which impose more stringent legal liabilities for certain violations. Such draft amendments were released for soliciting public comments and its final form, interpretation and implementation remain substantially uncertain.
On June 10, 2021, the Standing Committee of the National People’s Congress of China promulgated the PRC Data Security Law, which came into effect on September 1, 2021. The PRC Data Security Law provides for data security and privacy obligations on entities and individuals carrying out data processing activities, introduces a data classification and hierarchical protection system based on the importance of data in economic and social development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, or illegally acquired or used