Company: FRFXF
Filing Date: 2025-10-01
Form Type: F-10
Source: 0001104659-25-095645
Chunk: 83

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-10-01
Form: F-10
Chunk 83
---
 similar to those in the CCPA and CPRA, they exempt certain financial institutions, including insurers and insurance producers, and data subject to the Gramm-Leach-Bliley Act from their requirements.

In addition, states without comprehensive privacy laws, like New York, continue to signal their willingness to enforce privacy on consumer protection grounds, especially over website cookies and other web tracking technologies, based on existing consumer protection laws. Finally, there are several legislative proposals pending before the U.S. Congress and various state legislative bodies concerning privacy. Privacy regulation is an evolving area of state and federal regulation, which requires us to continue to monitor developments.

#### Cybersecurity
In 2017, the NAIC adopted an Insurance Data Security Model Law that establishes minimum cybersecurity requirements applicable to licensed insurance companies and licensed insurance intermediaries. Among other requirements, the Insurance Data Security Model Law requires licensees to maintain an information security program based on a cybersecurity risk assessment, establish a written incident response plan, provide an annual certification of compliance to state insurance regulators, and investigate and notify state insurance regulators regarding cybersecurity events. As of August 8, 2025, the NAIC reports that 28 jurisdictions have adopted a version of the Insurance Data Security Model Law or portions thereof and adopting legislation or rulemaking was pending in one jurisdiction. The New York Department of Financial Services already has a similar cybersecurity regulation in effect and adopted a number of substantial amendments to the regulation in November 2023 that further heighten its cybersecurity requirements, including with respect to governance, incident response and reporting, and implementing certain security controls. Most of the new requirements are now in effect, with the final remaining requirements set to take effect on or before November 1, 2025. Separately, Massachusetts also has regulations in place that require businesses to maintain a cybersecurity program that meets certain minimum requirements. See also “Risk Factors — Risk Factors Relating to Our Business — A disruption of our information technology systems could significantly affect our business.”

In March 2022, the U.S. government passed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“

### CIRCIA
”), which will require companies deemed to be part of U.S. critical infrastructure to report any “substantial” cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (“

#### CISA
”) of the U.S. Department of Homeland Security within 72 hours and ransomware payments within 24 hours. On April 4, 2024, CISA published proposed regulations, defining the scope of application and details around these reporting