Company: AHL
Filing Date: 2025-03-20
Form Type: F-1/A
Source: 0001628280-25-014149
Chunk: 363

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-20
Form: F-1/A
Chunk 363
---
 European Union General Data Protection Regulation’s (the “E.U. GDPR”) data protection obligations continue to apply to the U.K. in substantially unvaried form under the so-called “U.K. GDPR.” The U.K. GDPR exists alongside the U.K. Data Protection Act 2018 which implements certain derogations in the U.K. GDPR into U.K. law. Under the U.K. GDPR, companies not established in the U.K. but who process personal data (i.e., information which identifies or from which an individual is identifiable) in relation to the offering of goods or services to individuals in the United Kingdom, or to monitor their behavior will be subject to the U.K. GDPR and will be required to appoint a data protection representative in the U.K., provided certain exceptions are not met. Otherwise, the requirements of the U.K. GDPR are currently virtually identical to those of the E.U. GDPR and as such, may lead to similar compliance and operational costs. For information on E.U. GDPR and U.K. GDPR, refer also to “Risk Factors—Risks Related to Our Business—Other Operational Risks—Compliance with ever evolving national, federal, state, and international laws relating to the handling of information collected from or about individuals involves significant expenditure and resources, and any failure by us or our vendors to comply may result in significant liability, negative publicity and/or an erosion of trust, which could materially adversely affect our business, results of operations and financial condition.”

<div align='center'>238</div>

Table of C ontents

In addition, Brexit has implications for transfers of personal data between the U.K. and the EEA and vice versa. Transfers of personal data from the U.K. to the EEA and vice versa are unrestricted and do not require additional safeguards since the EEA has formally declared the U.K.’s data protection regime as “adequate” and similarly the U.K. has formally approved the adequacy of the E.U. As a result, transfers of personal data from the EEA to the U.K., and vice versa, remain unrestricted and do not require any additional safeguards. The duration of the current adequacy decision will expire on June 27, 2025, at which point the European Commission can decide whether to extend the adequacy decision for a further period up to a maximum of another four years.

E.U. / U.K. Cybersecurity and Privacy Laws and Regulations

The E.U. GDPR and U.K. GDPR (together referred to as the