Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 126

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 3
Chunk 126
---
 importance of network (including network facilities, information system, and data resources) in national security, economic construction, and social life, as well as various factors such as the degree of harm after its destruction, to implement hierarchical protection and supervision, with emphasis on ensuring the security of critical information infrastructure and networks at or above the third level.

On June 10, 2021, the Standing Committee of the National People’s Congress issued the PRC Data Security Law, which became effective on September 1, 2021. The PRC Data Security Law provides a national data security review system, under which, data processing activities that affect or may affect national security shall be reviewed. In addition, it clarifies the data security protection obligations of organizations and individuals carrying out data activities and implementing data security protection responsibility, data processors shall establish and improve the whole-process data security management rules, organize and implement data security trainings as well as take appropriate technical measures and other necessary measures to protect data security. Any organizational or individual data processing activities that violate the PRC Data Security Law shall bear the corresponding civil, administrative or criminal liabilities depending on specific circumstances.

The Opinions on Lawfully and Strictly Cracking Down Illegal Securities Activities, promulgated by the General Office of the CPC Central Committee and the General Office of the State Council on July 6, 2021, call for the enhanced administration and supervision of overseas-listed China-based companies, proposed to revise the regulation governing the overseas issuance and listing of shares by such companies and clarified the responsibilities of competent domestic industry regulators and government authorities. The opinions also called for the improvement of the laws and regulations on data security, cross-border data flow and confidential information management, and proposed to revise the provisions on strengthening confidentiality and archive administration of overseas issuance and listing of securities, to consolidate responsibility for information security of overseas listed companies, and to strengthen the standardized management of the cross-border information provision mechanism and process.

On July 30, 2021, the State Council promulgated the Regulations for the Security Protection of Critical Information Infrastructure, which became effective on September 1, 2021, defining “critical information infrastructures” as important network facilities and information systems in important industries including public communications and information services, as well as those that may seriously endanger national security, national economy, people’s livelihood, or public interests in the event of damage, loss of function, or data leakage. On November 14, 2021, the CAC published a draft of the Administrative Regulations for Internet Data Security, providing