Company: GHRS
Filing Date: 2025-07-29
Form Type: 20-F/A
Source: 0001140361-25-027850
Chunk: 86

Company: GH Research PLC
Filing Date: 2025-07-29
Form: 20-F/A
Chunk 86
---
 CPRA also creates a new state agency that is vested with authority to implement and enforce the CCPA and CPRA. Some observers have noted that the CCPA and CPRA could mark the beginning of a trend toward more stringent state privacy legislation in the United States, which could increase our potential liability and adversely affect our business. Other states, such as Nevada and Oklahoma and the U.S. federal government are considering comprehensive privacy laws, and on January 1, 2023, the Virginia Consumer Data Protection Act, or CDPA, became effective. The CDPA contains provisions that require businesses subject to the legislation to conduct data protection assessments in certain circumstances and that require opt-in consent from Virginia consumers to process certain sensitive personal information. In addition, Colorado enacted the Colorado Privacy Act, or the CoPA, and Connecticut enacted the Connecticut Data Privacy Act, each of which took effect on July 1, 2023, and Utah enacted the Consumer Privacy Act, which became effective on December 31, 2023. Several other states, including New Hampshire, Delaware, and Nebraska, have also enacted privacy laws that have taken effect in 2024 or will take effect in 2025. The CDPA, CoPA and such other proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The collection, use, storage, disclosure, transfer, or other processing of personal data (including health data processed in the context of clinical trials) regarding EU data subjects in the EEA and/or carried out in the context of our establishment in any EEA member state, is subject to the GDPR, and any legislation which amends, extends, consolidates, re-enacts or replaces the GDPR from time to time. 45 Table of Contents The GDPR is wide-ranging in scope and imposes numerous additional requirements on companies that process personal data of individuals residing in Europe, including imposing special requirements in respect of the processing of health and other sensitive data, requiring that consent of individuals to whom the personal data relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that appropriate safeguards are implemented to protect the security and confidentiality of personal data, creating mandatory data breach notification requirements in certain circumstances, and requiring that certain measures (including contractual requirements) are put in place when engaging third-party data processors. The GDPR permits data protection authorities