Company: IXHL
Filing Date: 2025-09-29
Form Type: 10-K
Source: 0001213900-25-092837
Chunk: 167

Company: Incannex Healthcare Inc.
Filing Date: 2025-09-29
Form: 10-K
Item: Item 1
Chunk 167
---
 damages resulting from
violations of the GDPR. Compliance with the GDPR has been and will continue to be a rigorous and time-intensive process that has increased
and will continue to increase our cost of doing business or require us to change our business practices, and despite those efforts, there
is a risk that we may be subject to fines and penalties, litigation and reputational harm in connection with any European activities,
which could adversely affect our business, prospects, financial condition and results of operations.

Additionally, following the United Kingdom’s
withdrawal from the European Union (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the
GDPR has been implemented in the United Kingdom (as the UK GDPR). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements
certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in
relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR -
the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance
and operational costs with potential fines of up to £17.5 million or 4% of global turnover.

Transfers of personal data to certain countries
outside of the EU and the UK are also highly regulated under the GDPR and UK GDPR. For example, the GDPR only permits exports of personal
data outside of the EU to “non-adequate” countries where there is a suitable data transfer mechanism in place to safeguard
personal data (e.g., the EU Commission approved Standard Contractual Clauses or certification under the newly-adopted Data Privacy Framework).
On July 16, 2020, the CJEU, issued a landmark opinion in the case Maximilian Schrems vs. Facebook (Case C-311/18) (“Schrems II”).
This decision calls into question certain data transfer mechanisms as between the EU member states and the U.S. The CJEU is the highest
court in Europe and the Schrems II decision heightened the burden to assess U.S. national security laws on their business, and future
actions of EU data protection authorities are difficult to predict at this time. While the Data Privacy Framework was meant to address
the concerns raised by the CJEU in Schrems II, it will likely be subject to future legal