Company: GIFLF
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001104659-25-034245
Chunk: 42

Company: Grifols SA
Filing Date: 2025-04-11
Form: 20-F
Item: Item 3
Chunk 42
---
 1, 2023, which amends the CCPA. The CPRA, among other substantive measures, expands the CCPA’s private right of action, increases consumers’ control over personal information, imposes new compliance obligations on businesses, and enacts new exceptions that may apply to our businesses. Notably, the CPRA created the California Privacy Protection Agency Board, which is responsible for enforcing the CCPA and CPRA, and which approved final CPRA regulations in February 2023. Other States in the United States either have or, presumably, will adopt similar laws.

26

The European Parliament and the Council of the European Union adopted the GDPR, which increased privacy rights for individuals in Europe, extended the scope of responsibilities for data controllers and data processors and imposed increased requirements and potential penalties on companies offering goods or services to individuals who are located in Europe or monitoring the behavior of such individuals (including by companies based outside of Europe). Noncompliance can result in penalties of up to the greater of €20.0 million, or 4.0% of global company revenues.
Our efforts to implement programs and controls that comply with the GDPR, CCPA, HIPAA and other data protection requirements are likely to impose additional costs on us, and we cannot predict whether the interpretations of the requirements, or changes in our practices in response to new requirements or interpretations of the requirements, could have a material adverse effect on our business.
Cyber-attacks or other privacy and data security incidents (for example involving the personal information of our plasma or blood donors) and could disrupt our business and expose us to significant losses, liability and reputational damage.
We and our third-party service providers routinely process, store and transmit large amounts of data in our operations, including sensitive personal information as well as proprietary or confidential information relating to our business or third parties, including our plasma or blood donors. We may be subject to breaches of the information technology security systems we use both internally and externally with third-party service providers.
Cyber-attacks may penetrate our and our third-party service providers’ security controls and result in the misappropriation or compromise of sensitive personal information or proprietary or confidential information (e.g. information regarding our plasma or blood donors), including such information which is stored or transmitted on the systems used by certain of our or their products, to create system disruptions, cause shutdowns (including disruptions to our production plants), or deploy viruses, worms, ransomware, denial-of-service attacks and other malicious software programs that attack our systems. We and our third-party service