Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 1048

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 1048
---
 our ability to share such personal information with unaffiliated third parties under certain circumstances. The GLBA also requires financial institutions to implement a comprehensive information security program that includes administrative, technical and physical safeguards to ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures for the protection of personal and confidential information are in effect across all businesses and geographic locations. An amendment to Regulation S-P, an implementing regulation under the GLBA, was adopted by the SEC on 16 May 2024, and requires registered investment advisers and broker/dealers to, among other things, adopt and implement an incident response program as part of their formal cybersecurity policies and procedures and report data breaches

| 954 |

| Contents |     | Cross-reference to Form 20-F |     | Consolidated director's report |     | Consolidated financial statements |     | Supplemental information |

to affected individuals whose sensitive customer information was, or is, reasonably likely to have been, accessed or used without authorization within 30 days of becoming aware of such data breach. Federal law also makes it a criminal offence, except in limited circumstances, to obtain or attempt to obtain customer information of a financial nature by fraudulent or deceptive means.

Like other lenders, Santander Bank and other of our US subsidiaries also use credit bureau data in their underwriting activities. Use of such data is regulated under the FCRA, and the FCRA also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Like other businesses in the US, our nonbanking US subsidiaries are also subject to the rules and regulations promulgated under the authority of the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to privacy, data protection and cybersecurity. Moreover, the United States Congress has recently considered, and is currently considering, various proposals for more comprehensive privacy, data protection and cybersecurity legislation, to which we and our US subsidiaries may be subject if passed.

In addition, the enactment of the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) in 2022, once rulemaking is complete, will require, among other things, certain companies to report significant cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours from the time the company reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). On 4 April 2024, the CISA proposed a