Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 130

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 3
Chunk 130
---
2024, the State Council published the Data Security Regulations, which became effective on January 1, 2025. The Data Security Regulations provide that data processors conducting the data processing activities that affect or may affect national security shall apply for cybersecurity review in accordance with the relevant laws and regulations. The Data Security Regulations subject network data processors to certain statutory obligations, including but not limited to: (i) network data processors shall, in accordance with the provisions of laws and administrative regulations and the mandatory requirements of national standards, and on the basis of classified protection of cyber security, strengthen the protection of network data security, establish and perfect the system of network data security management, and take technical measures such as encryption, backup, access control and security authentication as well as other necessary measures to protect network data from being falsified, destroyed, divulged or illegally acquired or used, dispose of network data security incidents, prevent illegal and criminal activities aiming at and using network data, and assume primary responsibility for the security of the network data processed by them; and (ii) data processors processing personal information of more than 10 million users shall specify the person in charge of network data security and the management body for network data security.

Regulations Relating to Internet Privacy

PRC government authorities enacted laws and regulations on internet use to protect personal information from any unauthorized disclosure. PRC law does not prohibit internet content provision operators from collecting and analyzing personal information from their users. However, the Administrative Measures on Internet Information Services prohibits an internet content provision operator from insulting or slandering a third party or infringing the lawful rights and interests of a third party.

The Several Provisions on Regulating the Market Order of Internet Information Services, which were promulgated by the MIIT on December 29, 2011 and became effective on March 15, 2012, stipulate that internet content provision operators must not collect user personal information without user consent. User personal information is defined as user information that can be used alone or in combination with other information to identify the user, and may not provide any such information to third parties without prior user consent. Internet content provision operators may only collect user personal information necessary to provide their services and must expressly inform the users of the method, content and purpose of the collection and processing of such user personal information. In addition, an internet content provision operator may only use such user personal information for the stated purposes under the internet content provision operator’s scope of service. Internet content provision operators are also required to ensure the proper security of user personal information and