Company: TME
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056949
Chunk: 51

Company: Tencent Music Entertainment Group
Filing Date: 2025-04-23
Form: 20-F
Item: Item 3
Chunk 51
---
 adapt to these announcement and provisions and future regulations, laws and policies, we could incur additional expenses.
In addition, if and to the extent we expand our operations into Europe, we may be required to comply with various laws and regulations, including the European Union (“EU”) General Data Protection Regulation (“GDPR”) or the United Kingdom (“UK”) General Data Protection Regulation (“UK GDPR”), which impose stringent obligations regarding the collection, control, use, sharing, disclosure and other processing of personal data, including obligations to notify relevant data protection authorities and affected individuals within strict time periods of applicable personal data breaches. Failure to comply with the GDPR or UK GDPR can result in significant fines and other liability, including fines up to EUR 20 million (or GBP 17.5 million under the UK GDPR) or 4% of

worldwide annual turnover of the preceding financial year, whichever is greater. Furthermore, any violation of the GDPR or UK GDPR by service providers that are acting as our data processors (i.e., processing personal data on our behalf) could also mean that we are subject to these fines and are required to comply with the notification obligations described above. While the UK GDPR currently imposes substantially the same obligations as the GDPR, the UK GDPR will not automatically incorporate changes to the GDPR going forward (which would need to be specifically incorporated by the UK government), which creates a risk of divergent parallel regimes and related uncertainty. Legal developments in the European Economic Area (“EEA”) have also created complexity and uncertainty regarding processing and transfers of personal data from the EEA and UK to so-called third countries. Complying with the GDPR, UK GDPR and other applicable regulatory requirements may cause us to incur substantial expenses or require us to alter or change our practices in a manner that could harm our business.
Further, if and to the extent we expand our operations into the United States, we may become subject to numerous federal, state and local privacy and data security laws and regulations governing the collection, sharing, use, retention, disclosure, protection, transfer and other processing of personal information. For example, at the federal level, Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive acts or practices in or affecting commerce (which extends to privacy and data security practices). At the state level, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”), broadly defines personal information and provides California residents expanded privacy rights and protections, including the right to opt out of certain sharing