Company: DAWN
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001193125-25-264649
Chunk: 81

Company: Day One Biopharmaceuticals, Inc.
Filing Date: 2025-11-04
Form: 10-Q
Item: Item 3
Chunk 81
---
 of up to the greater of 20 million Euros (17.5 million GBP in the UK) or 4% of their global annual revenues, potential bans on processing of personal information (including clinical trials), and private litigation. To the extent applicable, the GDPR will increase our responsibility and liability in relation to personal information that we process, and we may be required to put in place additional mechanisms and expend additional time and resources to ensure compliance with the EU data protection rules. Changes in international legislations may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment in resources for compliance 

76

programs, could impact strategies and availability of previously useful data, and could result in increased compliance costs and/or changes in business practices and policies. In addition, supervisory authorities in the EEA, Switzerland, and the UK have enforced data protection legislation inconsistently, which may result in us having to spend additional resources in order to comply with rules and guidance applicable only in certain, local jurisdictions.Further, European data protection laws generally prohibit the transfer of personal information to countries outside of the EEA, UK and Switzerland, such as the United States, which are not considered by their relevant authorities to provide an adequate level of data protection. Switzerland has adopted similar restrictions. Although there are legal mechanisms to allow for the transfer of personal information from the EEA, UK, and Switzerland to the United States and other countries, they are or may become subject to legal challenges that, if successful, could invalidate these mechanisms, restrict our ability to process personal information of Europeans outside of Europe and adversely impact our business. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. In the EU and other markets, potential new rules and restrictions on the flow of data across borders could increase the cost and complexity of doing business in those regions. In addition, further to the UK’s exit from the EU on January 31, 2020, the GDPR ceased to apply in the UK at the end of the transition period on December 31, 2020. However, as of January 1, 2021, the United Kingdom’s European Union (Withdrawal) Act 2018 incorporated the GDPR (as it existed on December 31, 2020 but subject to certain UK-specific amendments) into UK law, referred to as the UK GDPR. The UK GDPR and the UK Data Protection Act