Company: ARWR
Filing Date: 2025-11-25
Form Type: 10-K
Source: 0000879407-25-000029
Chunk: 63

Company: ARROWHEAD PHARMACEUTICALS, INC.
Filing Date: 2025-11-25
Form: 10-K
Item: Item 1
Chunk 63
---
 and obligations relating to the security and confidentiality of the personal data. EEA countries may also impose additional requirements in relation to processing of health, genetic and biometric data through their national  legislation.

Failure to comply with the requirements of the GDPR or UK GDPR and the related national data protection laws of the EEA countries may result in significant monetary fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company – whichever is greater. In addition, violations of national laws can trigger additional administrative penalties and investigations, corrective orders, temporary or definitive bans and, in some jurisdictions, a number of criminal offenses (punishable by capped or uncapped fines) for organizations and in certain cases their directors and officers as well as civil liability claims from individuals whose personal data was processed. Data protection authorities from the different EEA countries may still implement certain variations, enforce the GDPR and national data protection laws differently, and introduce additional national regulations and guidelines, which adds to the complexity of processing personal data in the EEA. Guidance developed at both EEA level and at the national level in individual EEA countries concerning implementation and compliance practices are often updated or otherwise revised.

There is, moreover, a growing trend towards required public disclosure of clinical trial data in the EU which adds to the complexity of obligations relating to processing health data from clinical trials. Such public disclosure obligations are provided in the EU Clinical Trials Regulation, EMA disclosure initiatives and voluntary commitments by industry. Failing to comply with these obligations could lead to government enforcement actions and significant penalties against us, harm to our reputation, and adversely impact our business and operating results. The uncertainty regarding the interplay between different regulatory frameworks, such as the Clinical Trials Regulation and the GDPR, further adds to the complexity that we face with regard to data protection regulation.

The GDPR also imposes specific restrictions on the transfer of personal data to countries outside of the EEA that are not considered by the European Commission to provide an adequate level of data protection. Appropriate safeguards are required to enable such transfers to countries outside the EEA that are not considered to provide an adequate level of data protection. Among the appropriate safeguards that can be used, the data exporter may use the standard contractual clauses (“SCCs”). In this respect, on June 4, 2021, the EU Commission issued a new set of SCCs which replace the old sets of SCCs that were adopted under the previous European Data Protection Directive 95/46. In addition, when relying on SCCs, the