Company: HURA
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0000950170-25-047921
Chunk: 161

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 161
---
 measures fail to comply with the GDPR requirements, we may be subject to litigation, regulatory investigations, enforcement notices requiring we to change the way we uses personal data and/or fines of up to 20 million Euros or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, as well as compensation claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill.

The GDPR may also impose additional compliance obligations relating to the transfer of data between us and our subsidiaries or other business partners. For example, the European Court of Justice recently invalidated the EU-U.S. Privacy Shield as a basis for transfers of personal data from the EU to the U.S. and raised questions about the continued validity of one of the primary alternatives to the EU-U.S. Privacy Shield, namely the European Commission’s Standard Contractual Clauses. Some customers or other service providers may respond to these evolving laws and regulations by asking us to make certain privacy or data-related contractual commitments that we are unable or unwilling to make. This could lead to the loss of current or prospective customers or other business relationships.

While we continue to address the implications of the recent changes to EU data privacy regulations, data privacy remains an evolving landscape at both the domestic and international level, with new regulations coming into effect and continued legal challenges, and our efforts to comply with the evolving data protection rules may be unsuccessful. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices. We must devote significant resources to understanding and complying with this changing landscape. Failure to comply with laws regarding data protection would expose us to risk of enforcement actions taken by data protection authorities in the EU and elsewhere and carries with it the potential for significant penalties if we are found to be non-compliant. Similarly, failure to comply with federal and state laws in the United States regarding privacy and security of personal information could expose us to penalties under such laws. Any such failure to comply with data protection and privacy laws could result in government-imposed fines or orders requiring that we change its practices, claims for damages or other liabilities, regulatory investigations and enforcement action, litigation and significant costs for remediation, any of which could adversely affect our business.

68

Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our business, financial condition, results of operations or prospects. Coverage and reimbursement may be limited or unavailable in certain market segments for our