Company: DAWN
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001193125-25-264649
Chunk: 82

Company: Day One Biopharmaceuticals, Inc.
Filing Date: 2025-11-04
Form: 10-Q
Item: Item 3
Chunk 82
---
 2018 set out the UK’s data protection regime, which is independent from but aligned to the EU’s data protection regime. Non-compliance with the UK GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher. With respect to transfers of personal data from the EU to the United Kingdom, on June 28, 2021 the European Commission issued an adequacy decision in respect of the UK’s data protection framework, enabling data transfers from EU member states to the UK to continue without requiring organizations to put in place contractual or other measures in order to lawfully transfer personal data between the territories. While it is intended to last for at least four years, the European Commission may unilaterally revoke the adequacy decision at any point, and if this occurs it could lead to additional costs and increase our overall risk exposure.Other countries, including China, Brazil, Australia and Japan, for example, have adopted certain legal requirements for local storage and processing of data and cross-border transfers of personal information, any and all of which could increase the cost and complexity of conducting preclinical testing and clinical trials or delivering our future products, if any, and operating our business. These obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practices.We are or may become subject to the terms of external and internal privacy and security policies, representations, certifications and publications related to privacy and security. Compliance with domestic and foreign privacy, data security and data protection laws, regulations and contractual and other obligations could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. The actual or perceived failure to comply with domestic and foreign privacy, data privacy and data protection laws and regulations could result in government enforcement actions (which could include civil, criminal and administrative penalties), private litigation and/or adverse publicity and could negatively affect our operating results and business. Moreover, clinical trial subjects about whom we or our potential collaborators obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information. Claims that we have violated individuals’ privacy rights, failed to comply with privacy, data security and data protection laws or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend and could result in adverse publicity that could harm our business.