Company: IOBT
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0000950170-25-047744
Chunk: 92

Company: IO Biotech, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1
Chunk 92
---
 PIPs by the EMA. 

64

European Data Collection 

The collection and use of personal data (including health data) in the EEA is governed by the EU General Data Protection Regulations (“GDPR”) and national implementing legislation in EEA States. The EU GDPR applies to any company established in the EEA and to companies established outside the EEA that process personal data in connection with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data subjects in the EEA. The EU GDPR establishes stringent requirements applicable to the processing of personal data, including strict requirements relating to the validity of consent of data subjects, expanded disclosures about how personal data is used, requirements to conduct data protection impact assessments for “high risk” processing, limitations on retention of personal data, special provisions for the processing of “special categories of personal data” including health and genetic information of data subjects, mandatory data breach notification (in certain circumstances), “privacy by design” requirements, and direct obligations on service providers acting as processors. The EU GDPR also prohibits the international transfer of personal data from the EEA to countries outside of the EEA unless made to a country deemed to have adequate data privacy laws by the European Commission or a data transfer mechanism has been put in place. Failure to comply with the requirements of the EU GDPR and the related national data protection laws of the EEA States may result in fines up to €20 million or 4% of a company’s global annual revenues for the preceding financial year, whichever is higher. Moreover, the EU GDPR affords various data protection rights to individuals (e.g., the right to erasure of personal data) in certain circumstances, and the ability for data subjects to claim material and non-material damages resulting from infringements of the EU GDPR. Given the breadth and depth of changes in data protection obligations, maintaining compliance with the EU GDPR, will require significant time, resources and expense, and we may be required to put in place additional mechanisms ensuring compliance with the evolving data protection rules. This may be onerous and adversely affect our business, financial condition, results of operations and prospects. These requirements and risks are set out in further detail in the section of this annual report titled “Risk Factors—Risks Related to Our Industry and Business Operations—We are subject to a variety of privacy and data security laws, and our failure to comply with them could harm our business.” 

Rest of the World Regulation 

For other countries outside of the EU (or in some cases, E