Company: TCOM
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001193125-25-078429
Chunk: 122

Company: Trip.com Group Ltd
Filing Date: 2025-04-11
Form: 20-F
Item: Item 4
Chunk 122
---
 not deceive or manipulate users. Failure to comply with the DSA can result in fines of up to 6% of total annual worldwide turnover and recipients of services have the right to seek compensation from providers in respect of damage or loss suffered due to infringement by the provider to comply with the DSA. 
 Our operations in the United Kingdom are also subject to increasing regulatory obligations, such as the Online Safety Act and the Digital Markets, Competition and Consumers Bill. There is a heightened risk of legal challenges or consumer backlash if regulatory frameworks are not adhered to, leading to damage to brand image and possible fines or sanctions. Increased oversight from regulatory bodies may restrict operational flexibility and innovation. 
 Regulations in Asia 
 We maintain operations in a number of jurisdictions in Asia, including Singapore, South Korea, and various other jurisdictions in Southeast Asia. 
 
72 

 In Singapore, the Personal Data Protection Act 2012, which is known as the PDPA, governs the collection, use and disclosure of the personal data of individuals by organizations, and is administered and enforced by the Personal Data Protection Commission, which is known as the PDPC. The PDPA sets out certain obligations which all organizations are required to comply with relating to the collection, use or disclosure of personal data, unless exceptions apply. Amongst other things, unless exceptions apply, the PDPA requires organizations to obtain consent from individuals, inform them of the purposes for which the organization will be collecting, using, or disclosing personal data, make reasonable security arrangements to protect the personal data in its possession or control from unauthorized access, modification, loss, or similar risks, only transfer personal data out of Singapore in accordance with prescribed requirements to ensure that the personal data is protected to a standard comparable to the protection under the PDPA, and notify the PDPC (and, unless exceptions apply, affected individuals) in the event of a notifiable data breach. 
 In South Korea, we are also subject to applicable privacy and data security regulations, regulations relating to the use of artificial intelligence, and regulations on e-commerce platforms. Various jurisdictions in Southeast Asia are also implementing additional regulations on privacy and data security and e-commerce platforms. For example, Vietnam adopted new regulations relating to the cross-border transfer of data in 2024, and Thailand, Indonesia, and Vietnam have each adopted filing requirements for e-commerce platforms. 
 

C.   Organizational Structure
-----------------------------
 The following diagram illustrates our corporate structure, including our significant subsidiaries and the VIEs as of December 31, 2024. 
 

 <img alt