Company: SUZ
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001628280-25-020368
Chunk: 64

Company: Suzano S.A.
Filing Date: 2025-04-28
Form: 20-F
Item: Item 3
Chunk 64
---
 to efficiently manage business processes. Therefore, disruptions to these systems may impact or even paralyze our business and negatively impact our operations. The sophistication of the threats continues to evolve and grow, including the risk associated with the use of emerging technologies, such as artificial intelligence, robotics, smart devices and remote working solutions. Additionally, we collect and store data, including proprietary business information, and may have access to confidential or personal information in certain activities of our businesses that is subject to privacy and security laws, regulations, and customer-imposed controls. Moreover, any failure of our systems or those of our third-party suppliers related to confidential information, caused by external cyber-attacks or internal actions, including negligence and misconduct of our employees, can negatively impact our reputation among competitors and external stakeholders (government, regulators, suppliers, and others).

Our third-party suppliers’ and our information technology systems may have vulnerabilities that may be impacted through external actions such as natural disasters, viruses, cyberattacks and other security breaches. Damage to or disruptions to certain critical systems could have a materially adverse effect on our business results, including fines, customer liabilities or legal litigation. Both we and our third-party suppliers may be subject to breaches of automation systems that can cause partial and temporary shutdowns of operations and unauthorized access to strategic information, in addition to changes or loss of relevant data. The costs associated with addressing these vulnerabilities and related issues may be significant, depending on the criticality and relevance of the information affected.

We cannot fully guarantee that our measures to deter unauthorized activities in our systems or the procedures adopted by third-party suppliers will protect us from certain types of attacks, which may have a material adverse effect on our business and reputation.

Any failure to adapt to or comply with global regulations on data privacy may adversely affect our results and reputation.

We are subject to various data protection laws in the jurisdictions where we operate, such as the European General Data Protection Regulation (GDPR), Brazil's General Data Protection Law (LGPD), China's Personal Information Protection Law (PIPL), and state laws in the United States. These laws establish rules that companies must follow whenever they process personal data, whether collecting, storing, using, transferring, or sharing data internally or with third parties.

Table of Co ntents

These laws impact the relationship between customers and suppliers of goods and services, employees and employers and other relationships in which personal data is collected, both in the digital and physical environment. Pursuant to these laws, security breaches that may result in significant risk or damage to personal data must be reported to the data