Company: HMDCF
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001410578-25-000377
Chunk: 58

Company: HUTCHMED (China) Ltd
Filing Date: 2025-03-19
Form: 20-F
Item: Item 1
Chunk 58
---
 be able to ensure and be able to demonstrate compliance with the GDPR. If our or our third-party partners’ privacy or data security measures fail to comply with the GDPR requirements, we may be subject to litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data and/or significant fines. In addition to statutory enforcement, non-compliance can lead to compensation claims by affected individuals, negative publicity and a potential loss of business. We are also subject to European laws on personal data export, as we may transfer personal data from the E. U. (or UK) to other jurisdictions which are not considered by the European Commission to offer “adequate” protection of personal data (such as Hong Kong or the United States). Following the Schrems II decision of the European Court of Justice in 2020, there has been intensified focus on exports of personal data which do not meet the high standards of protection expected by the E. U. Certain supervisory authorities in the E. U. have now begun to take enforcement action in this area, ordering restrictions on certain transfers of personal data to third countries such as the United States. These changes could require us to make operational changes and could increase costs and may lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity that could have an adverse effect on our business.

We believe, to the best of our knowledge, our business operations do not violate any of the above laws and regulations currently in force in all material aspects. We have been taking and will continue to take reasonable measures to comply with applicable data privacy, data protection and cybersecurity laws. We cannot guarantee the effectiveness of the measures undertaken by us and business partners, and such measures may still be determined as insufficient, improper, or even as user-privacy invasive, by the relevant authorities, which may result in penalties against us. Complying with all applicable laws, regulations, standards and obligations relating to data privacy, security, and transfers may cause us to incur substantial operational costs or require us to modify our data processing practices and processes. To the extent that we need to alter our business model or practices to adapt to these announcement and provisions and future regulations, laws and policies, we could incur additional expenses. We cannot assure you we can adapt our operations to it in a timely manner. Non-compliance could result in proceedings against us by data protection authorities, governmental entities or others, including class action privacy litigation in certain jurisdictions, which would subject us to significant fines, penalties, judgments and negative publicity. In addition, if our