Company: KARO
Filing Date: 2025-06-09
Form Type: 20-F
Source: 0001213900-25-052372
Chunk: 28

Company: Karooooo Ltd.
Filing Date: 2025-06-09
Form: 20-F
Item: Item 3
Chunk 28
---
 data will not increase. The United States and various state governments have adopted or proposed limitations on the collection,
distribution and use of personal information. Several foreign jurisdictions, including South Africa, Singapore and the European Union,
have adopted legislation (including directives or regulations) that increase or change the requirements governing data collection and
storage in these jurisdictions. Further, such data privacy laws and regulations may be amended in the future. Any failure to adhere to
or successfully implement processes in response to changing regulatory requirements in this area could result in legal liability or impairment
to our reputation in the marketplace, which could have a material adverse effect on our business, financial condition, results of operations
and prospects.

The current European Union legislation
related to data protection is the General Data Protection Regulation (“ GDPR”). While we appointed a Data Protection Officer
to oversee and supervise our compliance with European data protection regulations and have taken steps to mitigate the risks of GDPR,
we cannot provide any assurance that we are in compliance with all aspects of European data protection regulations, including GDPR. Despite
our ongoing efforts to bring practices into compliance, we may not be successful either due to various factors within our control, such
as limited financial or human resources, or other factors outside of our control. For example, while we seek to enter into data processing
agreements with third-parties with whom we share data, or who share data with us, we may be unable to execute agreements with all such
third-parties. It is also possible that local data protection authorities may have different interpretations of the GDPR, leading to potential
inconsistencies amongst various EU member states. The Artificial Intelligence Act of the European Union, also known as the EU AI Act or
the AI Act came into force on August 1, 2024, with different provisions of the law going into effect in different stages in 2025.

In Singapore, the Personal Data
Protection Act 2012, No. 26 of 2012 generally requires organizations to give notice and obtain consents prior to collection, use or disclosure
of personal data (data, whether true or not, about an individual who can be identified from that data or other accessible information).
The Protection of Personal Information Act, No. 4 of 2013 (the “ POPI Act”) applies to our South African subsidiaries.

In 2023, China issued its Interim
Measures for the Administration of Generative Artificial Intelligence Services.
Under the law, the provision and use of generative AI services must “respect the legitimate