Company: FRFXF
Filing Date: 2025-03-26
Form Type: 424B3
Source: 0001104659-25-028272
Chunk: 92

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-03-26
Form: 424B3
Chunk 92
---
 and (d) demonstrate compliance. Businesses are also required to perform
data protection impact assessments on a mandatory basis when undertaking high risk data processing activities, and to respond to requests
to exercise rights granted to individuals in respect of their personal data including to allow individuals to request access to their
data, the erasure/correction of their data and data portability (in some cases subject to certain restrictions).

The UK GDPR and EU GDPR
prohibit companies from transferring personal data from inside the EEA or the United Kingdom to countries that are outside the EEA or
the United Kingdom that are not considered to provide “adequate” protections to personal data unless an export solution is
in place or a derogation is used. Countries considered to be “adequate” are Andorra, Argentina, Canada (commercial organizations
only), Faroe Islands, Guernsey, Isle of Man, Israel, Japan (private-sector organizations only), Jersey, New Zealand, the Republic
of Korea, Switzerland, the United States (only commercial organizations participating in the EU-US Data Privacy Framework (“DPF”)
and Uruguay. The United Kingdom is also considered “adequate” under the EU GDPR in respect of transfers from the EEA, and
the EEA is considered “adequate” under the UK GDPR in respect of transfers from the United Kingdom.

In July 2020, a European
Court of Justice decision (“Schrems II”) invalidated one of the primary methods for transferring personal data to
the United States at the time (Privacy Shield) and placed additional conditions on the use of the main alternative export solution, the
Standard Contractual Clauses (the “SCCs”) (which could also be relied upon for transfers of personal data subject
to the UK GDPR, if used alongside an addendum approved by the U.K. Information Commissioner’s Office). On July 10, 2023, the
European Commission also adopted an “adequacy decision” in relation to the DPF, which enables the transfer of personal data
from the EEA to DPF-certified U.S. organizations without using the SCCs or other export mechanisms and replaces the transfer mechanism
from the European Union to companies in the United States that was invalidated by the Schrems II decision. Transfers can also be made
from the United Kingdom to DPF-certified US organizations without using the SCCs or other export mechanisms, provided that the U.S. organization
has certified to the “UK Extension” of the DPF.

<div