Company: TME
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056949
Chunk: 49

Company: Tencent Music Entertainment Group
Filing Date: 2025-04-23
Form: 20-F
Item: Item 3
Chunk 49
---
 network products or services or data processing activities affect or may affect national security.

Furthermore, on September 24, 2024, the State Council published the Regulation on Network Data Security Administration, or the Regulations on Network Data, which took effect on January 1, 2025. The Regulations on Network Data provides that data processing operators engaging in data processing activities that affect or may affect national security must be subject to network data security review. Network data processing activities refer to the collection, retention, use, processing, transmission, provision, disclosure, deletion, and other activities of network data. However, the Regulations on Network Data provides no further explanation or interpretation as to how to determine what “may affect national security,” and there remain uncertainties as to whether we would be subject to the cybersecurity review.
On February 6, 2023, the MIIT issued the Notice on Further Improving the Service Capability of Mobile Internet Apps, or the Mobile Internet Apps Notice. The Mobile Internet Apps Notice requires further enhancement of the service capability of mobile internet apps and reiterates the need to protect the legitimate rights and interests of the users and create a healthy service ecology. Specifically, the Mobile Internet Apps Notice emphasizes, among other things, the regulation of installation and unloading activities, the optimization of service experience, strengthening personal information protection, responding to users’ demands and the implementation of responsibilities of the developer and operator of mobile apps. However, since such notice is relatively new, uncertainty remains as to its interpretation and implementation in practice, as well as its ultimate impact on our business and results of operations in the long term. Failure to comply with such requirements may subject us to penalties and adversely affect our business, financial condition and results of operations.
On March 22, 2024, the CAC issued the Provisions on Promoting and Regulating Cross-border Data Flows, also known as the Cross-border Data Flows Provisions. According to these provisions, data processors are required to undergo a security assessment if they transfer information overseas under the following circumstances: (i) when a critical information infrastructure operator transfers personal information or material data overseas, and (ii) when data operators other than critical information infrastructure operators transfer material data overseas or, as of January 1 of the current year, have cumulatively transferred over one million pieces of personal information (excluding sensitive personal information) or over ten thousand pieces of sensitive personal information. The Cross-border Data Flows Provisions also outline exemptions from the data export security assessment for data processors transferring personal information overseas under certain conditions,