Company: TAK
Filing Date: 2025-06-25
Form Type: 20-F
Source: 0001395064-25-000095
Chunk: 214

Company: TAKEDA PHARMACEUTICAL CO LTD
Filing Date: 2025-06-25
Form: 20-F
Item: Item 16K
Chunk 214
---
 digital forensic or cyber recovery partners in connection with incident response activities.

Cybersecurity Incident Response

The TCR team has established an incident response procedure that governs our response to cybersecurity events and regularly conducts tabletop incident response exercises during the year. In the event a potential cybersecurity incident is detected, TCR’s core Cybersecurity Incident Response Team (“ CIRT”) is responsible with the support of Takeda’s MSSP, for investigation, analysis, containment and eradication of the threat, as well as recovery efforts, in coordination with other functions, such as Takeda’s Privacy Office, Human Resources, Crisis Management, Compliance and Legal, as needed depending on the severity and scope of the incident. Following recovery from an incident, CIRT analyzes the underlying cause of the incident to identify and, as applicable, implement potential improvements to internal controls.

Cyber Incident Impacts

During the three fiscal years ended March 31, 2025, no risks from cybersecurity threats, including previous incidents, have materially affected or are reasonably likely to materially affect Takeda, including its business strategy, results of operations or financial condition. Risks Relating to Our Business Strategies - We are increasingly dependent on information technology systems and our systems and infrastructure face the risk of misuse, theft, exposure, tampering or other intrusions. ”

Table of Contents

Governance

Takeda’s Board of Directors (the “ Board”) is ultimately responsible for overseeing Takeda’s management of cybersecurity risk and provides strategic direction for Takeda’s information security program and responses to cybersecurity risks and incidents. Takeda’sCISOgenerally provides an annual update to the Board on the status of Takeda’s information security program, including significant developments, and the Board receives reports of any decisions by any of Takeda’s Business and Sustainability Committee, Portfolio Review Committee or Risk, Ethics and Compliance Committee (see “ Item 6. Directors, Senior Management and Employees - C. Board Practices - Takeda Executive Team”) related to cybersecurity. In addition, the Board reviews and approves the Enterprise Risk Assessment, which includes significant cybersecurity risk matters, on an annual basis. On an as-needed basis, the Board is informed of, and provides strategic direction on, significant cybersecurity risks or incidents, if and when identified, by the CISO and CDTO.

The Risk, Ethics & Compliance Committee (“ RECC”)

Table of Contents

Part III