Company: ILLRW
Filing Date: 2025-01-24
Form Type: S-1
Source: 0001213900-25-006210
Chunk: 131

Company: Triller Group Inc.
Filing Date: 2025-01-24
Form: S-1
Chunk 131
---
 to collect and process data in the context of Triller’s EEA and/or United Kingdom
operations, and/or could cause Triller’s compliance costs to increase, ultimately having an adverse impact on Triller’s business
and harming Triller’s business and financial condition.

<div align='center'>68</div>

The EU GDPR also
regulates cross-border transfers of personal data and requires transferee countries to have protections equivalent to protections
available in the EU. The EU GDPR imposes strict rules on the transfer of personal data to countries outside the EEA, Switzerland or
the United Kingdom, including the United States, in respect of which the European Commission or the United Kingdom government has
not issued a so-called “adequacy decision” or “adequacy regulation” (known as “third
countries”), unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data.
This includes putting in place the European Commission’s Standard Contractual Clauses (“SCCs”) for
transfers outside of the EEA and a similar transfer mechanism for transfers of personal data outside of the United Kingdom, the
International Data Transfer Agreement or Addendum (“IDTA”). Under both the EU GDPR and the UK GDPR, exporters are
also required to assess the risk of the data transfer on a case-by-case basis, including conducting an analysis of the laws in the
destination country. The SCCs had to be in place by December 27, 2022, whereas the IDTA must be implemented in all existing
contracts by March 21, 2024. Finalizing the implementation of the updated SCCs and IDTA, and conducting the required risk
assessments, may continue to necessitate significant contractual overhaul of Triller’s data transfer arrangements with users,
sub-processors and vendors. On June 28, 2021, the European Commission published its decision recognizing the United Kingdom as
having adequate laws to the protect the rights and freedoms of data subjects such that personal data may transfer to from the EU to
the United Kingdom without an approved transfer mechanism. The decision is effective for four years and its continuing effect is
dependent on United Kingdom and regulation on data privacy not diverging materially from the EU GDPR. The United Kingdom Government
also confirmed that data transfers to the EU remain free flowing.

In addition, other European
data protection laws require that affirmative opt-in consent is procured to the placement of cookies and similar tracking technologies
on users’ devices (other than those that are “strictly necessary” to