Company: PLSAY
Filing Date: 2025-04-23
Form Type: 20-F/A
Source: 0001884082-25-000005
Chunk: 52

Company: Polestar Automotive Holding UK PLC
Filing Date: 2025-04-23
Form: 20-F/A
Chunk 52
---
 not been denied any permissions in the past. These permissions include the following:

• Business License;

• Pollutants Discharge Permit; and

• Customs Declaration Registration Certificate or Customs Declaration Enterprise Record Receipt.

See Item 3.D “ Risk Factors—Risks Related to Polestar’s Business and Industry—Polestar and its subsidiaries (i) may not receive or maintain permissions or approvals from the CAC or other relevant authorities to operate in China, (ii) may inadvertently conclude that such permissions or approvals are not required or (iii) may be required to obtain new permissions or approvals in the future due to changes in applicable laws, regulations, or interpretations related thereto ” for more information regarding risks associated with Polestar’s and its subsidiaries’ operations in China.

#### Focused regulatory areas
Some regulatory areas are rapidly changing within all the above-mentioned regulatory frameworks. The ones listed below are of key importance to Polestars products moving forward.

• Cyber security and privacy

• Electric vehicle safety

• Autonomous drive

In some of the relevant markets new requirements are enforced as guidelines and policies rather than regulations. Polestar’s ambition is always to meet relevant requirements for each product, market, and time frame.

Cyber security and privacy

Cybersecurity and cybersecurity management systems are being regulated in many markets to enhance data security protection measures and to minimize the risks associated with cyber threats.

Data privacy and data protection laws in the markets where Polestar operates influence Polestar’s abilities to collect and use personal information. For most markets, Polestar’s connected vehicle services, as well as its sales and marketing activities, are subject to European laws, including the EU General Data Protection Regulation 2016/679 (GDPR), in addition to applicable national law in each market, which impose requirements on processing of personal information. Following general guidance from the European Data Protection Board, much of the data in the context of connected vehicles may be viewed as personal data and therefore subject to the EU GDPR. In the US, Polestar needs to comply with the California Consumer Privacy Act (CCPA) and similar state-level comprehensive privacy laws which enter into force starting from 2023 in e.g. Virginia, Colorado and other states.

Violations of data privacy and data protection laws may result in consequences such as substantial fines, damages, ceasing with the infringing activity and deletion of erroneously collected information.

In China, several pieces of legislation have been adopted in recent years, applicable in part or in full to Polestar’s operations in China. These include the Data Security