Company: ZK
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0001410578-25-000390
Chunk: 76

Company: ZEEKR Intelligent Technology Holding Ltd
Filing Date: 2025-03-20
Form: 20-F
Item: Item 3
Chunk 76
---
, provides for a national security review procedure for those data activities which may affect national security and imposes export restrictions on certain data and information. The PRC Data Security Law provides that “data” refers to any recording of information by electronic or other means. Data processing includes the collection, storage, use, processing, transmission, availability and disclosure of data, etc.
On September 24, 2024, the State Council issued the Regulations on Network Data Security Management (the “Regulations on NDSM”) which came into force on January 1, 2025. The Regulations on NDSM provide detailed implementing rules and guidance on various aspects of data compliance requirements under the existing data protection framework pillars of the PRC Cybersecurity Law, the PRC Data Security Law and PRC Personal Information Protection Law, stipulating certain requirements on the protection of personal information, security of important data, management of cross-border security of network data and obligations of network platform service providers.
Laws and regulations stipulating on compliance requirements regarding overseas listing
According to the Cybersecurity Review Measures promulgated by the CAC and certain other PRC regulatory authorities in December 2021, which became effective in February 2022, the CIIO that intends to purchase internet products and services that affect or may affect national security shall apply for a cybersecurity review. On July 30, 2021, the State Council promulgated the Regulations on the Protection of the Security of Critical Information Infrastructure or the Regulations on SCII, which took effect in September 2021. The Regulations on SCII supplement and specify the provisions on the security of critical information infrastructure as stated in the Cybersecurity Review Measures. The Regulations on SCII provide, that “critical information infrastructures” shall mean any important network facilities or information systems of important industries or fields such as public communication and information service, energy, communications, water conservation, finance, public services, e-government affairs and national defense science, and any other important network facilities or information systems which may endanger national security, people’s livelihood and public interest in case of damage, function loss or data leakage. In addition, the Protection Departments are responsible to formulate eligibility criteria and determine the CIIOs in the respective industry or field. The operators shall be informed about the final determination as to whether they are categorized as CIIOs. The regulations further require CIIOs, among others, (i) to report to the competent Protection Departments in a timely manner when the identification result may be affected due to material changes in the critical information infra