Company: TME
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056949
Chunk: 9

Company: Tencent Music Entertainment Group
Filing Date: 2025-04-23
Form: 20-F
Item: Item 3
Chunk 9
---
: (i) when a critical information infrastructure operator transfers personal information or material data overseas, and (ii) when data operators other than critical information infrastructure operators transfer material data overseas or, as of January 1 of the current year, have cumulatively transferred over one million pieces of personal information (excluding sensitive personal information) or over ten thousand pieces of sensitive personal information. The Cross-border Data Flows Provisions also outline exemptions from the data export security assessment for data processors transferring personal information overseas under certain conditions, such as when a data processor other than a critical information infrastructure operator has cumulatively transferred personal information (excluding sensitive personal information) of fewer than 100,000 individuals as of January 1 of the current year.
On February 12, 2025, the CAC published the Administrative Measures for the Compliance Audit of Personal Information Protection, or the Compliance Audit Measures, which will take effect on May 1, 2025. According to the Compliance Audit Measures, compliance audit of personal information protection refers to the supervision activities in which the personal information processing activities of personal information processors are examined and evaluated regarding their compliance with laws and administrative regulations. The Compliance Audit Measures further provides, among other things, that personal information processors that process personal information of more than 10 million individuals shall conduct at least one personal information protection compliance audit every two years.
For information on regulatory developments in the European Union, United Kingdom and the United States relating to cybersecurity and data privacy, which may impact us if and to the extent we expand our operations into these jurisdictions, see “— 3.D. Risk Factors — Risks Related to Our Business and Industry — Complying with evolving laws, regulations and other obligations regarding cybersecurity, information security, privacy and data protection and other related laws, regulations and obligations may be

expensive and may force us to make adverse changes to our business. Many of these laws, regulations and other obligations are subject to changes and uncertain interpretations, and any failure or perceived failure to comply with these laws, regulations and other obligations could result in negative publicity, legal proceedings, suspension or disruption of operations, increased cost of operations, or otherwise harm our business.”
We have maintained a comprehensive and rigorous data protection program and implemented comprehensive and strict internal policies, procedures and measures designed to ensure our compliance with cybersecurity and data privacy laws and regulations.
Filings Required by the PRC Regulatory Authorities for the Listing of Our Securities
On February 17, 2023, China Securities Regulatory Commission (the “CSRC”) promulgated the Trial