Company: TME
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056949
Chunk: 47

Company: Tencent Music Entertainment Group
Filing Date: 2025-04-23
Form: 20-F
Item: Item 3
Chunk 47
---
, disruption or unauthorized access, and prevent network data from being disclosed, stolen or tampered.
In addition, the PRC Data Security Law was promulgated by the Standing Committee of the National People’s Congress on June 10, 2021 and took effect on September 1, 2021. The PRC Data Security Law establishes a tiered system for data protection in terms of their importance. Data categorized as “important data,” which will be determined by regulatory authorities in the form of catalogs, are required to be treated with higher level of protection. Specifically, the PRC Data Security Law provides that operators processing “important data” are required to appoint a “data security officer” and a “management department” to take charge of data security. In addition, such operator is required to evaluate the risk of its data activities periodically and file assessment reports with relevant regulatory authorities.
Numerous regulations, guidelines and other measures have been or are expected to be adopted under the umbrella of, or in addition to, the PRC Cyber Security Law and PRC Data Security Law. For example, Regulations on the Security Protection of Critical Information Infrastructure, or the CII Protection Regulations, was promulgated by the State Council of the PRC on July 30, 2021 and became effective on September 1, 2021. According to the CII Protection Regulations, critical information infrastructure, or the CII, refers to any important network facilities or information systems of the important industry or field such as public communication and information service, energy, transportation, water conservancy, finance, public services, e-government affairs and national defense science, which may endanger national security, people’s livelihood and public interest in the case of damage, function loss or data leakage. Regulators supervising specific industries are required to formulate detailed guidance to recognize the CII in the respective sectors, and a critical information infrastructure operator, or a CIIO, must take the responsibility to protect the CII’s security by performing certain prescribed obligations. For example, CIIOs are required to conduct network security test and risk assessment, report the assessment results to relevant regulatory authorities, and timely rectify the issues identified at least once a year. In addition, relevant administration departments of each critical industry and sector shall be responsible for formulating eligibility criteria and identifying CIIOs in the respective industry or sector. The operators shall be informed about the final determination as to whether they are categorized as CIIOs. As of the date of this annual report, no detailed rules or guidance with respect to