Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 128

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 3
Chunk 128
---
 organizations caused by such cross-border data transmission, (iii) the responsibilities and obligations that the overseas recipient of such data promises to undertake, and whether such overseas recipient’s management and technical measures and capabilities for performing its responsibilities and obligations can guarantee the security of cross-border data transmission, (iv) the risks that the data transmitted overseas may be falsified, destroyed, divulged, lost, transferred, illegally obtained, or illegally used during and after the cross-border transmission, and (v) whether contracts or other legally binding documents entered into with the overseas recipient have fully stipulated the responsibilities and obligations to protect data security. Furthermore, any cross-border data transmission activities conducted in violation of the Measures for the Security Assessment of Cross-Border Data Transmission before the effectiveness of the measures, which is September 1, 2022, are required to be rectified within six months of the effectiveness date.

On February 22, 2023, the CAC promulgated the Provisions on the Standard Contract for Personal Information Outbound Transfer, which became effective on June 1, 2023. The provisions state that the personal information processor who provides personal information abroad through execution of standard contract shall meet certain criteria, conduct an assessment on personal information protection impact before providing any personal information abroad, and complete the filing with local cybersecurity authority within ten working days from the effective date of the standard contract. The provisions attach a sample standard contract for personal information outbound transfer.

On March 22, 2024, the CAC promulgated the Provisions on Facilitating and Regulating Cross-border Data Flow, effective on the same date. The provisions require data processors to identify and declare important data in accordance with the regulations, and provide that, unless the competent departments or areas so notify or publicly release certain data as important data, the data processors do not need to apply for security assessment for outbound important data transfer for such data. The provisions set forth various circumstances exempted from application for security assessment for outbound data transfer, execution of a standard contract for personal information outbound transfer and passing of the certification for personal information protection. To the extent in compliance with the national data classification and hierarchical protection system framework, the provisions allow the pilot free trade zones to promulgate their own negative list of data requiring application for security assessment for outbound data transfer, execution of a standard contract for personal information outbound transfer or passing of the certification for personal information. The provisions further provide for, subject to exemptions set forth therein and negative lists of pilot free trade zones, circumstances requiring application for security assessment