Company: BDRX
Filing Date: 2025-01-28
Form Type: 424B3
Source: 0001214659-25-001409
Chunk: 73

Company: Biodexa Pharmaceuticals Plc
Filing Date: 2025-01-28
Form: 424B3
Chunk 73
---
 address the points raised in the Schrems IIjudgment. Notably, the new obligations were geared to ensure that data can be accessed by U.S. intelligence agencies only to the extent necessary and proportionate and to establish an independent and impartial redress mechanism to handle complaints from Europeans concerning the collection of their data for national security purposes. The UK-US Data Bridge (the UK extension to the Data Privacy Framework) came into force shortly after the E.U. – U.S. Data Privacy Framework, and provides UK individuals with similar rights. Organizations that have not certified under the under the E.U. – U.S. Data Privacy Framework (or the UK-US Data Bridge) may utilize another data transfer mechanism, such as the EU Commission approved Standard Contractual Clauses, or the UK equivalent, respectively. The European Commission and the UK government will continually review developments in the United States along with their adequacy decisions. Consequently, there is some risk of any data transfers from the EU and UK being halted. In addition, in June of 2021, the European Commission issued a decision, which will sunset on June 27, 2025 without further action, that the United Kingdom ensures an adequate level of protection for personal data transferred under the E.U. GDPR from the E.U. to the United Kingdom. Adequacy decisions can be adapted or even withdrawn in the event of developments affecting the level of protection in the applicable jurisdiction.

| 37 |

Failure to comply with European Union laws, including failure under the GDPR and UK GDPR, Data Protection Act 2018, ePrivacy Directive and other laws relating to the security of personal data may result in fines up to €20 million (or £17.5 million under the UK GDPR) or up to 4% of the total worldwide annual turnover of the preceding financial year, if greater, and other administrative penalties including criminal liability, which may be onerous and adversely affect our business, financial condition, results of operations and prospects. The GDPR and UK GDPR also confer a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR and UK GDPR, respectively. Failure to comply with the GDPR, UK GDPR, and related laws may lead to increased risk of private actions from data subjects and consumer not-for-profit organizations, including a new form of class action that is available under the GDPR and UK GDPR. Further, if we have to rely on third parties to carry out services for us,