Company: TME
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056949
Chunk: 50

Company: Tencent Music Entertainment Group
Filing Date: 2025-04-23
Form: 20-F
Item: Item 3
Chunk 50
---
 such as when a data processor other than a critical information infrastructure operator has cumulatively transferred personal information (excluding sensitive personal information) of fewer than 100,000 individuals as of January 1 of the current year.
On February 12, 2025, the CAC published the Administrative Measures for the Compliance Audit of Personal Information Protection, or the Compliance Audit Measures, which will take effect on May 1, 2025. According to the Compliance Audit Measures, compliance audit of personal information protection refers to the supervision activities in which the personal information processing activities of personal information processors are examined and evaluated regarding their compliance with laws and administrative regulations. The Compliance Audit Measures further provides, among other things, that personal information processors that process personal information of more than 10 million individuals shall conduct at least one personal information protection compliance audit every two years.
We believe, to the best of our knowledge, that our and the VIEs’ business operations do not violate any of the above PRC laws and regulations currently in force in all material aspects except for the risks and uncertainties as disclosed in this annual report. We have been taking and will continue to take reasonable measures to comply with such laws, regulations, announcement, provisions and inspection requirements. However, since these laws and regulations in China are relatively new, uncertainties still exist in relation to their interpretation and implementation. Any change in laws and regulations relating to privacy, data protection and information security and any enhanced and scrutinized enforcement action of such laws and regulations could greatly increase our cost in providing our products and services, limit their use or adoption or require certain changes to be made to our operations. We cannot assure you that we will be compliant with these new laws and regulations described above in all respects, and we may be ordered to rectify and terminate any actions that are deemed illegal by the regulatory authorities and become subject to fines and other regulatory sanctions, which may materially and adversely affect our business, financial condition, and results of operations. Evolving interpretations of such laws, regulations, announcements and provisions or any future regulatory changes might impose additional restrictions or obligations on us and the VIEs for generating and processing personal information and other data. We and the VIEs may be subject to additional regulations, laws and policies adopted by the PRC regulators. In response to these additional regulations, laws and policies, we and the VIEs may apply more stringent social and ethical standards in our cybersecurity and data privacy policies. To the extent that we need to alter our and the VIEs’ business model or practices to