Company: LENZ
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001815776-25-000071
Chunk: 240

Company: LENZ Therapeutics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Part II, Item 1A
Chunk 240
---
, or partners, even if we do not explicitly authorize or have prior knowledge of such activities.

Restrictive laws and regulations govern the collection, use, transfer, and other processing of personal information. 

In conducting and/or enrolling patients in current or future clinical trials, we are subject to restrictions relating to privacy, data protection and cybersecurity and may be subject to additional restrictions associated with clinical operations in the future. For example, the collection, use, storage, disclosure, transfer, or other processing of personal data regarding individuals in the EU, including personal health data, is subject to the General Data Protection Regulation (“GDPR”), which is wide-ranging in scope and imposes numerous requirements on companies that process personal data. The GDPR permits data protection authorities to impose large penalties for violations, including potential fines of up to €20 million or 4% of annual global revenue, whichever is greater, for the most serious of violations. The GDPR also confers a private right of action on data subjects and consumer associations. Certain aspects of cross-border data transfers under the GDPR are uncertain as the result of legal proceedings in the EU, including a July 2020 decision by the Court of Justice for the European Union (“CJEU”) that invalidated the EU-U.S. Privacy Shield and called into question the efficacy and legality of using standard contractual clauses (“SCCs”). To address certain concerns of the CJEU, the European Commission issued revised SCCs in June 2021. The EU also has enacted numerous new laws and regulations addressing cybersecurity.

In the United Kingdom (“UK”), the Data Protection Act of 2018 implements and complements the GDPR and is effective along with a version of the GDPR referred to as the UK GDPR. These regimes authorize significant fines, up to the greater of £17.5 million or 4% of global turnover, and expose us to two parallel regimes and potentially divergent enforcement actions. Further, aspects of data protection in the UK remain uncertain. On June 28, 2021, the European Commission issued an adequacy decision, pursuant to which personal data generally may be transferred from the EU to the UK without restriction; however, this adequacy decision is subject to a four-year “sunset” period, after which it may be renewed. This decision may be revoked or modified at any time. Additionally, the UK’s Information Commissioner’s Office has issued standard contractual clauses to support personal data transfers out of the UK (“UK SCCs”). Regulatory guidance and other developments relating to cross-border personal data transfers, including the necessity of putting