Company: TME
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056949
Chunk: 174

Company: Tencent Music Entertainment Group
Filing Date: 2025-04-23
Form: 20-F
Item: Item 4
Chunk 174
---
” primarily are core network equipment, high-performance computers and servers, mass storage equipment, large databases and applications, network security equipment, cloud computing services, and other network products and services that may have an important impact on the security of critical information infrastructure.

In addition, the PRC Data Security Law was promulgated by the Standing Committee of the National People’s Congress on June 10, 2021 and took effect on September 1, 2021. The PRC Data Security Law establishes a tiered system for data protection in terms of their importance. Data categorized as “important data,” which will be determined by regulatory authorities in the form of catalogs, are required to be treated with higher level of protection. Specifically, the PRC Data Security Law provides that operators processing “important data” are required to appoint a “data security officer” and a “management department” to take charge of data security. In addition, such operator is required to evaluate the risk of its data activities periodically and file assessment reports with relevant regulatory authorities.
On July 6, 2021, the General Office of the Central Committee of the Communist Party of China and the General Office of the State Council jointly issued the Opinions on Strictly Cracking Down Illegal Securities Activities in Accordance with the Law, which request improvement on the laws and regulations related to data security, cross-border data transfer and the management of confidential information, strengthening principal responsibility for the information security of overseas listed companies, strengthening standardized mechanisms for providing cross-border information, and improvement of cross-border audit regulatory cooperation in accordance with the law and the principle of reciprocity.
Regulations on the Security Protection of Critical Information Infrastructure, or the CII Protection Regulations, became effective on September 1, 2021. According to the CII Protection Regulations, critical information infrastructure, or the CII, refers to any important network facilities or information systems of the important industry or field such as public communication and information service, energy, transportation, water conservancy, finance, public services, e-government affairs and national defense science, which may endanger national security, people’s livelihood and public interest in the case of damage, function loss or data leakage. Regulators supervising specific industries are required to formulate detailed guidance to recognize the CII in the respective sectors, and a critical information infrastructure operator, or a CIIO, must take the responsibility to protect the CII’s security by performing certain prescribed obligations. For example, CIIOs are required to conduct network security test and risk assessment, report the assessment results to relevant