Company: GROY-WT
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0000950170-25-042306
Chunk: 95

Company: Gold Royalty Corp.
Filing Date: 2025-03-20
Form: 20-F
Item: Item 16K
Chunk 95
---
ITEM 16K. Cybersecurity.

We maintain programs and technologies to ensure that our information systems are effective and prepared for data privacy and cybersecurity risks, including regular oversight of our security programs for monitoring internal and external threats to ensure the confidentiality and privacy of our data. As the volume and complexity of cyber-attacks continue to evolve, we continue to enhance our security capabilities by continued

investment in cyber technologies, further developing our internal cybersecurity personnel and educating our workforce regarding cyber-security and leveraging emerging technologies.
Risk Management and Strategies
Our board of directors have adopted a Cybersecurity Policy to serve as a standard for setting, reviewing and implementing our cybersecurity goals, objectives and targets. Our Cybersecurity Policy serves as a framework within which risks to the confidentiality, integrity or availability of our assets within our information technology network and infrastructure ("Cyberspace") are managed, and applies to all of our directors, officers, employees, consultants and contractors. We regularly perform evaluations of our security program and continue to implement controls aligned with industry guidelines to identify threats, detect attacks and protect data. Our risk management strategy is focused on three areas: (i) technology, being our hardware and software systems; (ii) processes, being our cybersecurity reporting, testing and other processes; and (iii) people, which refers to our internal cybersecurity personnel, external service providers and individual training and human interaction within our information technology and cybersecurity processes.
When reviewing third-party information technology service providers, our engagement process customarily includes, among other things, a review of such providers' cybersecurity measures.
We periodically undertake cybersecurity audits, the results of which are reported to our Audit Committee. We have also implemented security monitoring programs designed to alert us of any suspicious activity and have developed an incident response program in the event of a security breach.
We implement various training programs periodically to ensure that our employees and other personnel comply with internal processes and to enhance their cybersecurity awareness. Member of our board of directors and management overseeing our information security risk management approach are provided with opportunities for continuing education in cybersecurity and evolving cybersecurity risks in order to better understand and evaluate our preparedness.
Additionally, we have engaged third-party providers to supplement our response capabilities for both informational and operational technology incidents, as needed.
See also "Item 3. Key Information - D. Risk Factors - Risks Related to our Business - A significant disruption to our information technology systems or those of our third-party service providers could adversely affect our business and operating results".
Governance
Our board of directors oversees our Cybersecurity Policy primarily through the Audit Committee. TheAudit Committee