Company: GLXG
Filing Date: 2025-10-24
Form Type: 20-F
Source: 0001213900-25-102144
Chunk: 38

Company: Galaxy Payroll Group Ltd
Filing Date: 2025-10-24
Form: 20-F
Item: Item 3
Chunk 38
---
 required. We cannot assure that there will not be any changes in the regulatory
environment in respect of the payroll outsourcing service industry and/or the employment service industry in the PRC, Hong Kong, Taiwan
and Macau which may be unfavorable to our Group.

Failure to comply with privacy, data protection
and cyber security laws and regulations could have a materially adverse effect on our reputation, results of operations or financial condition,
or have other adverse consequences.

The collection, storage,
hosting, transfer, processing, disclosure, use, security and retention and destruction of personal information required to provide our
services is subject to federal, state and foreign privacy, data protection and cyber security laws. These laws, which are not uniform,
generally do one or more of the following: regulate the collection, storage, hosting, transfer (including in some cases, the transfer
outside the country of collection), processing, disclosure, use, security and retention and destruction of personal information; require
notice to individuals of privacy practices; give individuals certain access and correction rights with respect to their personal information;
and regulate the use or disclosure of personal information for secondary purposes such as marketing. Under certain circumstances, some
of these laws require us to provide notification to affected individuals, clients, data protection authorities and/or other regulators
in the event of a data breach. In many cases, these laws apply not only to third-party transactions, but also to transfers of information
among the Company and its subsidiaries.

We believe that providing
insights from data, including artificial intelligence and machine learning, will become increasingly important to the value that our solutions
and services deliver to our customers. However, the ability to provide data-driven insights may be constrained by current or future regulatory
requirements or ethical considerations that could restrict or impose burdensome and costly requirements on our ability to leverage data
in innovative ways.

Complying with privacy, data
protection and cyber security laws and requirements may result in significant costs to our business and require us to amend certain of
our business practices. Further, enforcement actions and investigations by regulatory authorities related to data security incidents and
privacy violations continue to increase. The future enactment of more restrictive laws, rules or regulations and/or future enforcement
actions or investigations could have a materially adverse impact on us through increased costs or restrictions on our businesses and noncompliance
could result in significant regulatory penalties and legal liability and damage our reputation. In addition, data security events and
concerns about privacy abuses by other companies are changing consumer and social expectations for enhanced