Company: DAWN
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000950170-25-026654
Chunk: 201

Company: Day One Biopharmaceuticals, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 201
---
 in business practices and policies. In addition, supervisory authorities in the EEA, Switzerland, and the UK have enforced data protection legislation inconsistently, which may result in us having to spend additional resources in order to comply with rules and guidance applicable only in certain, local jurisdictions.

Further, European data protection laws generally prohibit the transfer of personal information to countries outside of the EEA, UK and Switzerland, such as the United States, which are not considered by their relevant authorities to provide an adequate level of data protection. Switzerland has adopted similar restrictions. Although there are legal mechanisms to allow for the transfer of personal information from the EEA, UK, and Switzerland to the United States and other countries, they are or may become subject to legal challenges that, if successful, could invalidate these mechanisms, restrict our ability to process personal information of Europeans outside of Europe and adversely impact our business. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. In the EU and other markets, potential new rules and restrictions on the flow of data across borders could increase the cost and complexity of doing business in those regions. 

In addition, further to the UK’s exit from the EU on January 31, 2020, the GDPR ceased to apply in the UK at the end of the transition period on December 31, 2020. However, as of January 1, 2021, the United Kingdom’s European Union (Withdrawal) Act 2018 incorporated the GDPR (as it existed on December 31, 2020 but subject to certain UK-specific amendments) into UK law, referred to as the UK GDPR. The UK GDPR and the UK Data Protection Act 2018 set out the UK’s data protection regime, which is independent from but aligned to the EU’s data protection regime. Non-compliance with the UK GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher. With respect to transfers of personal data from the EU to the United Kingdom, on June 28, 2021 the European Commission issued an adequacy decision in respect of the UK’s data protection framework, enabling data transfers from EU member states to the UK to continue without requiring organizations to put in place contractual or other measures in order to lawfully transfer personal data between the territories. While it is intended to last for at least four years,