Company: GCL
Filing Date: 2025-04-08
Form Type: 424B3
Source: 0001213900-25-029989
Chunk: 130

Company: GCL Global Holdings Ltd
Filing Date: 2025-04-08
Form: 424B3
Chunk 130
---
 2012 of Singapore (the “Singapore PDPA”) governs the collection, use and
disclosure of the personal data of individuals (being data, whether true or not, about an individual who can be identified from that
data or other accessible information), and to provide individuals with the right to access and correct their own personal data.
Organizations have mandatory obligations to assess data breaches they suffer, and to notify the Personal Data Protection Commission
(the “PDPC”) and where applicable, the relevant individuals where the data breach is (or is likely to be)
of a significant scale or resulting in (or is likely to result in) significant harm to individuals. Other obligations include
accountability, protection, retention, and requirements around the overseas transfers of personal data.

Organizations are required to, among other things,
(i) obtain consent from individuals and inform them of the applicable purposes before collecting, using or disclosing their personal
data; and (ii) put in place reasonable measures to (a) protect the personal data in their possession or control from unauthorized
access, loss or damage and (b) prevent the loss of any storage medium or device on which personal data is stored. In the event of
a data breach involving any personal data in an organization’s possession or control, the Singapore PDPA requires the organization
to reasonably and expeditiously assess whether the data breach is notifiable and notify the PDPC and, unless exceptions apply, the affected
individuals of the data breach, if the data breach is assessed to be one that (a) is likely to result in significant harm or impact
to the individuals to whom the information relates, or (b) is, or is likely to be, of a significant scale. Other obligations include
accountability, retention and requirements around the overseas transfers of personal data.

In addition, Do-Not-Call (“DNC”)
requirements require organizations to check “Do-Not-Call” registries prior to sending marketing messages addressed to Singapore
telephone numbers, through voice calls, fax or text messages, unless clear and unambiguous consent to such marketing was obtained from
the individual.

Non-compliance with the Singapore PDPA may attract
financial penalties or even criminal liability. The PDPC has broad powers to give any such directions as it thinks fit to ensure compliance,
which include requiring an organization to pay a financial penalty. In this connection: (i) in the case of contravention of the parts
of the Singapore PDPA which sets out the obligations of organizations relating