Company: TCOM
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001193125-25-078429
Chunk: 43

Company: Trip.com Group Ltd
Filing Date: 2025-04-11
Form: 20-F
Item: Item 3
Chunk 43
---
 of our management and our other resources. Furthermore, we cannot assure you that we will obtain the clearance or approval for these applications from the Cybersecurity Review Office and the government authorities in a timely manner, or at all. If we are found to be in violation of cybersecurity requirements in China, the government authorities may conduct investigations, levy fines, request app stores to take down our apps, and cease to provide viewing and downloading services related to our apps, prohibit the registration of new users on our platform, or require us to change our business practices in a manner materially adverse to our business. Any of these actions may disrupt our operations and materially and adversely affect our business, financial condition, and results of operations. 
 
27 

 The European Union traditionally takes a broader view as to what is considered personal information and has imposed greater obligations under their privacy and data protection laws. In particular, the European Union adopted the General Data Protection Regulation in April 2016, which came into effect in May 2018. The General Data Protection Regulation results in more stringent requirements for data processors and controllers, including more fulsome disclosures about the processing of personal information, data retention limits, and deletion requirements, mandatory notification in the case of a data breach, and elevated standards regarding valid consent in some specific cases of data processing. The General Data Protection Regulation also includes substantially higher penalties for failure to comply with the requirements. For example, in the event of violations, a fine up to 20 million Euros or up to 4% of the annual worldwide turnover, whichever is greater, may be imposed. In addition to the General Data Protection Regulation, when other future laws and regulations relating to data privacy come into effect, the more stringent requirements on privacy user notifications and data handling will require us to adapt our business and incur additional costs. 
 In addition, to the extent we have accessed data in Hong Kong and Macao, we have been in compliance with the laws and regulations in both jurisdictions regarding data security, such as the Personal Data (Privacy) Ordinance and the Unsolicited Electronic Messages Ordinance, which impose protocols and obligations regarding the handling of personal data in Hong Kong including, among other things, that (i) personal data must be collected for a lawful purpose, necessary, and not excessive, (ii) personal data must be collected by means that are lawful and fair in the circumstances of the case, and (iii) the person from whom personal data is collected is informed of the purpose of collecting the data. As of the date of this annual report, we believe that these