Company: AHL
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001267395-25-000019
Chunk: 47

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-19
Form: 20-F
Item: Item 3
Chunk 47
---
 liability, negative publicity and/or an erosion of trust, which could materially adversely affect our business, results of operations and financial condition.

We receive, store, handle, transmit, use and otherwise process business information and information related to individuals, including from and about actual and prospective customers, policyholders, as well as our employees and service providers. We also depend on a number of third party vendors in relation to the operation of our business, a number of which process data on our behalf.

We are subject to a range of data privacy and cyber security laws globally including those that apply generally to the handling of information about individuals, and those that are specific to certain industries, sectors, contexts or locations. These requirements, and their application, interpretation and amendment are constantly evolving and developing as set out in “ Certain Regulatory Considerations - Bermuda Insurance Regulation - Privacy & Cyber Security Laws,” “ - U. K. and E. U. Insurance Regulation - E. U. / U. K. Cybersecurity and Privacy Laws and Regulations” and “ - U. S. Regulation - Cybersecurity and Privacy Laws and Regulations.”

Our business is also subject to the Bermuda Personal Information Protection 2016 Act (“ PIPA”). For more information, refer to “ Certain Regulatory Considerations - Bermuda Insurance Regulation - Privacy & Cyber Security Laws.” In addition to U. K./E. U. and Bermuda privacy laws, our business is subject to various U. S. state and federal privacy legislation, including both state financial privacy and insurance laws which apply specifically to our business lines, and potentially more generally applicable state privacy laws, with the most comprehensive having been enacted in California. U. S. state legislatures, attorneys general, and insurance and other regulatory bodies continue to develop and implement further standards and governance requirements. Such evolving privacy and data security regulations could expose our business to reputational harm and cause losses.

We depend on a number of third parties in relation to the operation of our business, a number of which process personal data on our behalf. There can be no assurances that the privacy and security-related measures and safeguards we have put in place in relation to these third parties will be effective to protect us and/or the relevant personal data from the risks associated with the third-party processing, storage and transmission of such data. Any violation of data or security laws, or of our relevant measures and safeguards, by our third party processors could have a material adverse effect on our business, result in applicable fines and penalties, damage our reputation and/or result in civil claims.

We are also subject to