Company: PLSAY
Filing Date: 2025-04-23
Form Type: 20-F/A
Source: 0001884082-25-000005
Chunk: 53

Company: Polestar Automotive Holding UK PLC
Filing Date: 2025-04-23
Form: 20-F/A
Chunk 53
---
 Law and the Personal Information Protection Law, which entered into force in 2021. Both laws impose requirements on data activities or personal information processing activities, including security reviews and specific requirements on activities on data regarding Chinese persons carried out outside of China. The Several Measures on the Automobile Data Security Management (for Trial Implementation) from the CAC, which entered into force in October 2021, imposes requirements on processing of personal information and important data during the process of designing, manufacturing, selling, maintaining, managing automobiles within the territory of China. It specifically requires the operators to store certain personal information and important data within the territory of China, or in case overseas transfers are necessary, to go through the data export security assessment organized by the CAC in accordance with such laws.

The Cybersecurity Review Measures from the CAC, which came into effect in February 2022, requires data processors in China who hold more than one million users’ personal information and plan to list on a stock exchange in a foreign country to apply for a cybersecurity review. It also gives the CAC the power to initiate cybersecurity review in certain situations.

The Cross-border Data Transfer Security Measures (the “ Security Assessment Measures ”) from the CAC, effective from September 2022, requires security assessment for data being exported. Data handlers must submit application materials to the CAC offices at the provincial level for the security assessment within a six-month “rectification period”.

In addition to the legislative requirements to protect personal data, Polestar operations are subject to various regulations concerning cybersecurity in general. In Europe, the NIS 2 directive and corresponding national legislation require Polestar to maintain a cybersecurity management system ensuring that Polestar’s data and digital assets are protected against cyber-attacks. This includes for example operational aspects such as Vulnerability and Network Protection Management, Security Incident Management as well as steering and reporting functions such as Cyber-Risk Management and Reporting to the Management and the Board.

SOX Standards toward the Security and Integrity of Financial and operational data apply to Polestars systems and operations. These regulations include Protection of relevant Systems and Data, detailed Incident Detection and Reaction mechanisms and plans as well as performant risk management including Reporting to Management and Board.

The Industry and Information Technology Field Data Security Administrative Measures (for Trial Implementation) promulgated by the Ministry of Industry and Information Technology of China, which became effective on January 1, 2023, regulate the data

<div align='center'>20</div>

processing activities of certain industrial and technology businesses operating in the PRC. Data handlers