Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 1050

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 1050
---
 cybersecurity-related notification rule that requires banking organizations to notify their primary federal regulator as soon as possible and within 36 hours of incidents that, among other things, have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. The rule also imposes requirements on bank service providers to notify their affected banking organization customers of certain computer-security incidents.

Privacy, data protection and cybersecurity are also areas of increasing state legislative focus, and states are increasingly proposing or enacting legislation that relates to privacy, data protection and cybersecurity. Various state laws and regulations apply, or may apply in the future, to Santander Holdings USA’s and our subsidiaries’ operations, and may impose additional requirements on Santander Holdings USA and our subsidiaries or otherwise impact Santander Holdings USA’s or our subsidiaries’ ability to share certain personal information with affiliates or non-affiliates for marketing or other purposes, or to contact customers with marketing offers.

For example, the CCPA applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds. The CCPA gives California residents the right to, among other things, request disclosure of personal information collected about them, and whether that information has been sold or shared with others, the right to request deletion of personal information (subject to certain exceptions), the right to opt out of the sale of their personal information, and the right not to be discriminated against for exercising their rights. The CCPA contains a private right of action for California residents as well as enforcement capabilities for both the California Attorney General and a state agency created under the California Privacy Rights Act. The CCPA contains several exemptions, including an exemption applicable to personal information that is collected, processed, sold or disclosed subject to the GLBA. While the CCPA does not currently have, and is not expected to have, a material impact on Banco Santander’s US operations, the CCPA is

| 955 |

| Contents |     | Cross-reference to Form 20-F |     | Consolidated director's report |     | Consolidated financial statements |     | Supplemental information |

indicative of a trend towards greater state-level regulation of privacy, data protection and cybersecurity in the United States. A number of other states have enacted, or are considering enacting, comprehensive data privacy laws that share similarities with the CCPA. In addition, laws in all 50 US states