Company: TME
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056949
Chunk: 48

Company: Tencent Music Entertainment Group
Filing Date: 2025-04-23
Form: 20-F
Item: Item 3
Chunk 48
---
 the implementation of such regulations had been issued by any regulatory authorities and we had not been identified as a CIIO by any regulatory authorities. Furthermore, the exact scope of CIIOs under the current regulatory regime remains unclear. Therefore, it is uncertain whether we would be deemed as a CIIO under PRC law.
The Personal Information Protection Law of the PRC, which was promulgated by the Standing Committee of the National People’s Congress on August 20, 2021 and took effect on November 1, 2021, integrates the various rules with respect to personal information rights and privacy protection and applies to the processing of personal information within the Chinese mainland as well as certain personal information processing activities outside the Chinese mainland, including those for the provision of products and services to natural persons within China or for the analysis and assessment of acts of natural persons within China.
Additionally, in December 2021, the CAC and several other administrations jointly promulgated the amended Cybersecurity Review Measures, or the Cybersecurity Review Measures, which took effect on February 15, 2022, and superseded and replaced the cybersecurity review measures that became effective since June 2020. Pursuant to the Cybersecurity Review Measures, where the relevant activity affects or may affect national security, a CIIO that purchases network products and services, or an internet platform operator that conducts data processing activities, shall be subject to the cybersecurity review. The Cybersecurity Review Measures also expands the cybersecurity review to internet platform operators in possession of personal information of over one million users if such operators intend to list their securities in a foreign country. The Cybersecurity Review Measures elaborate the factors to be considered when assessing the national security, including but not limited to the risks of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or illegally exited the country, risks of critical information infrastructure, core data, important data or a large amount of personal information data being affected, controlled and maliciously used by foreign governments after a listing, and risks associated with Internet information security. See “— Risks Related to the Group’s Corporate Structure — The approval, filing or other requirements of the China Securities Regulatory Commission or other PRC regulatory authorities may be required under PRC law in connection with any future issuance of securities overseas, and, if required, we cannot predict whether or for how long we will be able to obtain such approval or complete such filing.” Additionally, relevant regulatory authorities in the PRC may initiate cybersecurity review if they determine an operator’s