Company: TME
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056949
Chunk: 8

Company: Tencent Music Entertainment Group
Filing Date: 2025-04-23
Form: 20-F
Item: Item 3
Chunk 8
---
. Additional Information — 10.E. Taxation.”
Recent Regulatory Developments
Cybersecurity and Data Privacy
The PRC regulatory authorities have in recent years strengthened the oversight on cybersecurity and data privacy. According to the institutional reform plan of the State Council approved by the National People’s Congress on March 10, 2023, the National Data Bureau has been established under the administration of the NDRC on October 25, 2023. The National Data Bureau is responsible for, among other things, advancing the development of data-related fundamental institutions, coordinating the integration, sharing, development and application of data resources, and promoting the digitalization of the Chinese economy and society. On June 10, 2021, the Standing Committee of the National People’s Congress promulgated the PRC Data Security Law, which took effect in September 2021. On August 20, 2021, the Standing Committee of the National People’s Congress promulgated the Personal Information Protection Law of the PRC, effective from November 1, 2021. On December 28, 2021, the CAC, the NDRC, the MIIT, and several other PRC regulatory authorities jointly issued the Cybersecurity Review Measures, which became effective on February 15, 2022. Pursuant to the Cybersecurity Review Measures, critical information infrastructure operators that procure internet products and services, and network platform operators engaging in data processing activities, must be subject to the cybersecurity review if their activities affect or may affect national security. The Cybersecurity Review Measures further stipulate that network platform operators holding over one million users’ personal information shall apply with the Cybersecurity Review Office for a cybersecurity review before listing in a foreign country. On September 24, 2024, the State Council published the Regulations on Network Data Security Administration, or the Regulations on Network Data, which took effect on January 1, 2025. The Regulations on Network Data provides that data processing operators engaging in data processing activities that affect or may affect national security must be subject to network data security review. Network data processing activities refer to the collection, retention, use, processing, transmission, provision, disclosure, deletion, and other activities of network data.
On March 22, 2024, the CAC issued the Provisions on Promoting and Regulating Cross-border Data Flows, also known as the Cross-border Data Flows Provisions. According to these provisions, data processors are required to undergo a security assessment if they transfer information overseas under the following circumstances