Company: AHL
Filing Date: 2025-05-08
Form Type: 424B4
Source: 0001628280-25-023859
Chunk: 359

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-05-08
Form: 424B4
Chunk 359
---
 law, such as whether consent can be used as the legal basis for processing. As these laws develop, we may need to make operational changes to adapt to these diverging rules, which could increase our costs and adversely affect our business.

Failure to comply with the GDPR could result in penalties for noncompliance. Since we are potentially subject to the supervision of various E.U. Member State / U.K. data protection authorities under both the E.U. GDPR and the U.K. GDPR, it is not excluded that we are faced with enforcement action in various E.U. / U.K. jurisdictions. Penalties for certain breaches are up to the greater of EUR 20 million/GBP 17.5 million or 4% of our global annual turnover. In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease/change our data processing activities, enforcement notices, assessment notices (for a compulsory audit) and/or civil claims (including class actions).

The GDPR regulates cross-border transfers of personal data out of the EEA and the U.K. Case law from the Court of Justice of the European Union (“CJEU”) states that reliance on the standard contractual clauses – a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism – alone may not necessarily be sufficient in all circumstances, and that transfers must be assessed on a case-by-case basis and supported by a transfer impact assessment followed by the implementation of additional protection measures as appropriate. On October 7, 2022, President Biden signed an Executive Order on ‘Enhancing Safeguards for United States Intelligence Activities’ which introduced new redress mechanisms and binding safeguards to address the concerns raised by the CJEU in relation to data transfers from the EEA to the United States and which formed the basis of the new E.U.-U.S. Data Privacy Framework (“DPF”), as released on December 13, 2022. The European Commission adopted its adequacy decision in relation to the DPF on July 10, 2023, rendering the DPF effective as an E.U. GDPR transfer mechanism to U.S. entities self-certified under the DPF. On October 12, 2023, the U.K. Extension to the DPF came into effect (as approved by the U.K. Government) as a U.K. GDPR data transfer mechanism to U.S. entities self-certified under the U.K. Extension to the DPF. We currently rely on the E.U. standard contractual