Company: SMNR
Filing Date: 2025-10-21
Form Type: S-1
Source: 0001193125-25-245178
Chunk: 256

Company: Semnur Pharmaceuticals, Inc.
Filing Date: 2025-10-21
Form: S-1
Chunk 256
---
 Standard Contractual Clauses alone may not necessarily be sufficient in all circumstances. Use of the Standard Contractual Clauses must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular regarding applicable surveillance laws and relevant rights of individuals with respect to the transferred data. In the context of any given transfer, where the legal regime applicable in the destination country may or does conflict with the intended operation of the Standard Contractual Clauses and/or applicable European law, the decision in Schrems II and subsequent draft guidance from the European Data Protection Board (the “EDPB”) would require the parties to that transfer to implement certain supplementary technical, organizational and/or contractual measures to rely on the Standard Contractual Clauses as a lawful “transfer mechanism.” However, the draft guidance from the EDPB on such supplementary technical, organizational and/or contractual measures appears to conclude that any combination of such measures may not be sufficient to allow effective reliance on the Standard Contractual Clauses in the context of transfers of personal data “in the clear” to recipients in countries where the power granted to public authorities to access the transferred data goes beyond that which is “necessary and proportionate in a democratic society”—which may, following the CJEU’s conclusions in Schrems II on relevant powers of United States public authorities and commentary in draft EDPB guidance, include the United States in certain circumstances (e.g., where Section 702 of the U.S. Foreign Intelligence Surveillance Act applies). Further, the UK Information Commissioner’s Office has provided for separate international data transfer mechanisms for restricted transfers of data from the UK: an international data transfer agreement (the UK equivalent of the EU Standard Contractual Clauses) (“IDTA”) and an international data transfer addendum (which amends the EU Standard Contractual Clauses for purposes of international data transfers from the UK to countries without an essentially equivalent data protection framework) (the “Addendum”). Both the IDTA and the Addendum came into force in March 2022.

If we are unable to implement a valid solution to transfer personal data from the EEA to the United States or other countries that have not been deemed to provide an essentially equivalent level of data protection, we may face increased exposure to regulatory action, substantial fines, or injunction orders to stop processing personal data from EEA, Swiss, or UK residents. Any inability to import personal data to the United States may also restrict our clinical trials activities in the EU; limit our ability to collaborate with contract research organizations as well as