Company: GHRS
Filing Date: 2025-07-29
Form Type: 20-F/A
Source: 0001140361-25-027850
Chunk: 88

Company: GH Research PLC
Filing Date: 2025-07-29
Form: 20-F/A
Chunk 88
---
 Act of 2018, which retains the GDPR in the UK’s national law. In particular, the collection, use, storage, disclosure, transfer, or other processing of personal data (including health data processed in the context of clinical trials) regarding data subjects in the UK and/or carried out in the context of the activities of our establishment in the UK is subject to the UK GDPR and the UK Data Protection Act of 2018. With respect to transfers of personal data from the EEA, on June 28, 2021, the European Commission issued an adequacy decision in respect of the UK’s data protection framework, enabling data transfers from EU member states to the UK to continue without requiring organizations to put in place contractual or other measures in order to lawfully transfer personal data between the territories. While this adequacy decision will automatically expire on June 27, 2025, (unless renewed by the European Commission before then), the European Commission may unilaterally revoke the adequacy decision at any point, and if this occurs it could lead to additional costs and increase our overall risk exposure. Other countries have also passed or are considering passing laws requiring local data residency or restricting the international transfer of data. In addition, Europe and other foreign jurisdictions have enacted laws, regulations, standards and common practices that relate to the privacy of clinical trial data, including as a condition to approve clinical trials. These requirements are evolving and uncertain and they may result in delays to our ability to launch clinical trials or limit the jurisdictions in which we may conduct clinical trials. 46 Table of Contents The GDPR and UK GDPR may increase our responsibility and liability in relation to personal data that we process where such processing is subject to the GDPR and the UK GDPR. While we have taken steps to comply with the GDPR and UK GDPR and implementing legislation in applicable EEA member states, including by seeking to establish appropriate lawful bases for the various processing activities we carry out as a controller or joint controller, reviewing our security procedures and those of our vendors and collaborators, and entering into data processing agreements with relevant vendors and collaborators, we cannot be certain that our efforts to achieve and remain in compliance have been, and/or will continue to be, fully successful. The regulatory framework for data privacy and security issues in the United States and abroad is rapidly evolving and likely to remain uncertain for the foreseeable future. Compliance with applicable privacy and data protection laws and regulations is a rigorous and time-intensive process and could require us to take on more onerous obligations in our contracts, restrict our ability to collect,