Company: IOBT
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0000950170-25-047744
Chunk: 204

Company: IO Biotech, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 204
---
 right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the EU GDPR. The EU GDPR increases our responsibility and liability in relation to personal data that we process, and additional mechanisms put in place to address compliance with the EU GDPR must be kept under review as the legislative and regulatory landscape for data protection in the EU continues to evolve.

Relatedly, following Brexit, the EU GDPR has been implemented in the United Kingdom (as the “UK GDPR”). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but that process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR – the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs with potential fines of up to £17.5 million or 4% of global turnover. The UK Government has published its own form of SCCs, known as the International Data Transfer Agreement and International Data Transfer Addendum to the EU SCCs. The UK Information Commissioner’s Office has also published its own version of the transfer impact assessment and recently revised guidance on international transfers, although entities may choose to adopt either the EU or UK style transfer impact assessment. In terms of international data transfers between the UK and US, it is understood that the UK and the US are also negotiating an adequacy agreement.  

99

Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to devote additional resources to and put in place additional mechanisms ensuring compliance with the new data protection and disclosure rules. Despite our efforts to comply with these laws and regulations, the inherent complexity of data security and cyber threats, and the newness of some of these requirements, such as the SEC’s cybersecurity disclosure requirements, present a risk of non-compliance or insufficient disclosure, which could invite regulatory scrutiny and affect our operational and financial performance. Furthermore, the laws are not consistent, and compliance in the event of a widespread data breach is costly. In addition, states are constantly adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act (the “CCPA”), which took effect on January 1,