Company: TME
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056949
Chunk: 175

Company: Tencent Music Entertainment Group
Filing Date: 2025-04-23
Form: 20-F
Item: Item 4
Chunk 175
---
 regulatory authorities, and timely rectify the issues identified at least once a year. In addition, relevant administration departments of each critical industry and sector shall be responsible to formulate eligibility criteria and determine the CIIO in the respective industry or sector. The operators shall be informed about the final determination as to whether they are categorized as CIIOs.
On September 24, 2024, the State Council published the Regulation on Network Data Security Administration, or the Regulation on Network Data, which took effect on January 1, 2025. The Regulation on Network Data provides that data processing operators engaging in data processing activities that affect or may affect national security must be subject to network data security review. Network data processing activities refer to the collection, retention, use, processing, transmission, provision, disclosure, deletion, and other activities of network data. However, the Regulation on Network Data provides no further explanation or interpretation as to how to determine what “may affect national security,” and there remain uncertainties as to whether we would be subject to the cybersecurity review.
On December 28, 2021, the CAC, the NDRC, the MIIT, and several other PRC regulatory authorities jointly issued the Cybersecurity Review Measures which became effective on February 15, 2022 and replaced the Measures for Cybersecurity Review promulgated on April 13, 2020. Pursuant to the Cybersecurity Review Measures, critical information infrastructure operators that procure internet products and services, and network platform operators engaging in data processing activities, must be subject to the cybersecurity review if their activities affect or may affect national security. The Cybersecurity Review Measures further stipulate that network platform operators holding over one million users’ personal information shall apply with the Cybersecurity Review Office for a cybersecurity review before listing in a foreign country. The relevant regulatory authorities may initiate the cybersecurity review against the relevant operators if the authorities believe that the network products or services or data processing activities of such operators affect or may affect national security.
Regulations on Privacy Protection
On December 29, 2011, the MIIT promulgated the Several Provisions on Regulation of Order of Internet Information Service Market, which prohibit internet information service providers from collecting personal information of any user without prior consent. Internet information service providers shall explicitly inform the users of the means of collecting and processing personal information, the scope of content, and purposes. In addition, internet information service providers shall properly keep the personal information of users, if the preserved personal information of users is divulged or may possibly be divulged, internet information