Company: HURA
Filing Date: 2025-05-06
Form Type: S-4/A
Source: 0001193125-25-113920
Chunk: 252

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-05-06
Form: S-4/A
Chunk 252
---
 to put in place additional mechanisms ensuring compliance with the new data protection rules. Furthermore, the laws are not consistent, and compliance in the event of a widespread data breach is costly. In addition, states are constantly adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act (the “CCPA”), which took effect on January 1, 2020, became enforceable by the California Attorney General on July 1, 2020, and has been dubbed the first “GDPR-like” law in the United States. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their

<div align='center'>148</div>

personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provide such consumers new ways to opt-outof certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Further, the California Privacy Rights Act (the “CPRA”) recently passed in California. The CPRA will impose additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data and opt outs for certain uses of sensitive data. It will also create a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions will go into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. Although the CCPA currently exempts certain health-related information, including clinical trial data, the CCPA and the CPRA may increase Kineta’s compliance costs and potential liability. Similar laws have been adopted in other states (for example Nevada, Virginia and Colorado) or proposed in other states and at the federal level, and if passed, such laws may have potentially conflicting requirements that would make compliance challenging. Any actual or perceived failure by Kineta to comply with applicable privacy and data security laws and regulations could result in regulatory investigations, reputational damage, orders to cease/change Kineta’s processing of its data, enforcement notices and/or assessment notices (for a compulsory audit). Kineta may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or