Company: IMCR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001671927-25-000006
Chunk: 77

Company: Immunocore Holdings plc
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 77
---
. In light of the fact that the United Kingdom has left the EU, the HTA Regulation does not apply in the United Kingdom. However, the MHRA is working with UK HTA bodies and other national organizations, such as the Scottish Medicines Consortium ("SMC"), the National Institute for Health and Care Excellence ("NICE"), and the All-Wales Medicines Strategy Group, to introduce new pathways supporting innovative approaches to the safe, timely and efficient development of medicinal products.

Data Privacy and Security Laws

We are subject to privacy laws in the jurisdictions in which we operate, have partners, or sell or market our products or run clinical trials, and may in the future become subject to additional laws. For example, we are subject to the EU’s General Data Protection Regulation ("EU GDPR"), the United Kingdom’s equivalent law ("U.K. GDPR") (collectively, "GDPR"), and the Health Insurance Portability and Accountability Act as amended ("HIPAA"), in the United States, among others. Our regulatory obligations could harm the use or cost of our solution as data protection and privacy laws and regulations around the world continue to evolve.

36

Table of Contents

The United Kingdom and member states of the EU (the “Member States”), each may introduce further restrictions on personal data processing, including limitations which could limit our ability to collect, use and share personal data (including health and medical information), or could cause our compliance costs to increase. In particular, the GDPR restricts certain transfers of personal data to the United States and other countries whose privacy laws are considered ‘inadequate’ for the purposes of either or both of those regulations, as they may apply. If there is no lawful manner for us to effect cross-border transfers of personal data in compliance with the GDPR, as applicable, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate certain parts of our operations, increased exposure to regulatory actions, substantial fines and penalties, the inability to work with certain collaborators, partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business.

Sanctions for breaches of the GDPR are significant: companies may face temporary or definitive bans on processing of personal data and other corrective actions; fines of up to £17.5 million under the U.K. GDPR and €20 million under the EU GDPR, or, in each case, 4% of annual global revenue