Company: ABUS
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001447028-25-000083
Chunk: 67

Company: Arbutus Biopharma Corp
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1
Chunk 67
---
, disclosure and other processing activities concerning patient health information abroad. We may be required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy, data protection and cybersecurity laws, to protect against security breaches and hackers, to notify breaches with competent authorities, and to alleviate problems caused by such breaches. Compliance with these laws is difficult, constantly evolving, time consuming, and requires a flexible privacy framework and substantial resources. Compliance efforts will likely be an increasing and substantial cost in the future. There are also a number of legislative proposals in the European Union, the United States, at both the federal and state level, and other jurisdictions that could impose new obligations or limitations in areas affecting our business. In addition, some countries are considering or have passed legislation implementing data protection requirements such as local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our services and research activities. These laws and regulations, as well as any associated claims, inquiries, or investigations or any other government actions may lead to unfavorable outcomes including increased compliance costs, delays or impediments in the development of 

 28

new products, negative publicity, increased operating costs, diversion of management time and attention, and remedies that harm our business, including fines or demands or orders that we modify or cease existing business practices. The GDPR imposes significant fines and other administrative penalties to which we could be subject in the event of any non-compliance, including fines of up to EUR 10,000,000 or up to 2% of our total worldwide annual turnover for certain comparatively minor offenses, or up to EUR 20,000,000 or up to 4% of our total worldwide annual turnover for more serious offenses. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with data protection authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. 

With regard to the transfer of personal data, the GDPR generally restricts the ability of companies to transfer personal data from the European Economic Area to the United States and other countries, which may adversely affect our ability to transfer personal data or otherwise may cause us to incur significant costs for implementing lawful transfer mechanisms, conducting data transfer impact assessments, and implementing additional measures where necessary to ensure that personal data transferred are adequately protected in a manner essentially equivalent to the EU. The GDPR provides different transfer mechanisms we can use to lawfully transfer personal data from the EU to countries outside the EU. An example is relying on adequacy decisions of the European Commission, such