Company: PLSAY
Filing Date: 2025-05-09
Form Type: 20-F
Source: 0001884082-25-000012
Chunk: 52

Company: Polestar Automotive Holding UK PLC
Filing Date: 2025-05-09
Form: 20-F
Item: Item 3
Chunk 52
---
 our business and the manner in which Polestar interacts with its customers. Polestar may be required to put in place additional mechanisms to comply with such laws and regulations, which could cause Polestar to incur substantial costs or require Polestar to change its business practices, including its data practices, in a manner adverse to its business. In particular, certain emerging privacy laws are still subject to a high degree of uncertainty as to their interpretation and application. Failure to comply with applicable laws or regulations or to secure personal information could result in investigations, violations of data privacy laws, enforcement actions and other proceedings against Polestar, which could result in substantial fines, damages and other liability as well as damage to Polestar’s reputation and credibility, which could have a negative impact on revenues and profits.

Additionally, on July 26, 2023, the SEC adopted new cybersecurity disclosure rules for public companies that require disclosure regarding cybersecurity risk management (including the corporate board’s role in overseeing cybersecurity risks, management’s role and expertise in assessing and managing cybersecurity risks, and processes for assessing, identifying and managing cybersecurity risks) in annual reports. These new cybersecurity disclosure rules also require the disclosure of material cybersecurity incidents in a Form 6-K, generally within four days of determining an incident is material.

There are also ongoing complex, uncertain, rapid development and changes of data privacy and security related laws in China. Polestar and its business partners in China could be affected by intervention by the Chinese government relating to, for example, information-sharing and cybersecurity matters. The risk of such interventions could be heightened in connection with a listing of shares of Polestar or any of its business partners, and could result in prohibitions of the sale and/or marketing of certain products. For example, on December 28, 2021, the CAC published the Cybersecurity Review Measures, which came into effect on February 15, 2022, specifying that the cybersecurity review must be conducted in the event the data processing operators in possession of personal information of over 1 million users intend to list their securities in a foreign country. Polestar has not exceeded this threshold as of the date of this Report. However, under the Cybersecurity Review Measure, the CAC could also initiate cybersecurity review under certain situations, for example, if a regulatory agency within the cyber-security review coordination mechanism believes a network product or service, data processing activity impacts or might impact Chinese national security. If Polestar would be subject to such review and be found to be non-compliant with applicable data protection laws