Company: IOBT
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0000950170-25-047744
Chunk: 202

Company: IO Biotech, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 202
---
 are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure and protection of personal information, including federal and state health information privacy laws, federal and state security breach notification laws, and federal and state consumer protection laws. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues, including with respect to regulatory enforcement and private litigation, which may affect our business and is expected to increase our compliance costs and exposure to liability. In the United States, numerous federal and state laws and regulations could apply to our operations or the operations of our partners, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws and regulations (e.g., Section 5 of the FTC Act), that govern the collection, use, disclosure, and protection of health-related and other personal information. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that may be subject to privacy and security requirements under HIPAA, as amended by HITECH and regulations promulgated thereunder. Depending on the facts and circumstances, we could be subject to significant penalties if we obtain, use, or disclose, or are subject to an actual or alleged data breach regarding, individually identifiable health information in a manner that is not authorized or permitted by HIPAA. In 2023, the SEC finalized rules requiring enhanced disclosures regarding cybersecurity risk management, strategy, and governance, as well as the timely reporting of material cybersecurity incidents. These rules mandate disclosures about our processes for identifying, assessing, and managing cybersecurity risks, the role of management and the board of directors in overseeing these risks, and specific incidents that materially affect us.

98

In the EEA, we are subject to the EU GDPR, which took effect in May 2018. The EU GDPR governs the collection, use, disclosure, transfer or other processing of personal data (i.e., data which identifies an individual or from which an individual is identifiable), including clinical trial data, and grants individuals various data protection rights (e.g., the right to erasure of personal data). The EU GDPR imposes a number of obligations on companies, including inter alia: (1) accountability and transparency requirements, and enhanced requirements for obtaining valid consent; (2) obligations to consider data protection as any new products or services are developed and to limit the amount of personal data processed; (3) obligations to implement appropriate technical and organizational measures to