Company: TCOM
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001193125-25-078429
Chunk: 110

Company: Trip.com Group Ltd
Filing Date: 2025-04-11
Form: 20-F
Item: Item 4
Chunk 110
---
 form of catalogs, are required to be treated with higher level of protection. In addition, such operator is required to evaluate the risks of its data activities periodically and file assessment reports with the regulatory authorities. 
 
65 

 The PRC Personal Information Protection Law integrates a variety of rules with respect to personal information rights and privacy protection and applies to the processing of personal information within mainland China and certain personal information processing activities outside mainland China, including those for the provision of products and services to natural persons within China or for the analysis and assessment of acts of natural persons within China. According to this law, the CAC promulgated the Security Assessment Measures for Data Outbound Transfer to outline the requirements and procedures for security assessments on export of important data or personal information collected or generated within the territory of China. In March, 2024, the CAC further issued the Provisions on Facilitating and Regulating Cross-border Data Flow, according to which data processors who transfer personal information outbound may be exempt from the requirements for security assessment, standard contract filing and obtaining security certification under certain circumstances, including when it is necessary to transfer personal data overseas for the purpose of executing and performing a contract to which the individual is a party, such as air ticket and hotel reservation. 
 The Cybersecurity Review Measures set forth that, where the activity affects or may affect national security, a critical information infrastructure operator that purchases network products and services, or an internet platform operator that conducts data process activities, must be subject to the cybersecurity review; “internet platform operators” in possession of personal information of over one million users are also subject to the cybersecurity review requirement if such operators intend to pursue a foreign listing. Additionally, PRC governmental authorities may initiate cybersecurity review if they determine an internet platform operator’s network products or services or data processing activities affect or may affect national security. According to the Regulations on the Security Protection of Critical Information Infrastructure, the critical information infrastructure operator must perform certain obligations to protect the critical information infrastructure’s security, including but not limited to, conducting network security test and risk assessment at least once a year. The security protection departments are responsible for organizing the identification of critical information infrastructure in their respective industries and areas in accordance with the identification rules, and will inform the identification results to the operators in a timely manner and report such results to the public security department of the State Council. According to the Administrative Regulations on Network Data Security, network data processors who carry out network data processing activities that affect or may affect national security shall go through national security review in accordance with relevant regulations. In