Company: HURA
Filing Date: 2025-08-12
Form Type: S-1
Source: 0001193125-25-179009
Chunk: 59

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-08-12
Form: S-1
Chunk 59
---
 data. The GDPR imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and policies. If TuHURA’s or TuHURA’s partners’ or service providers’ privacy or data security measures fail to comply with the GDPR requirements, TuHURA may be subject to litigation, regulatory investigations, enforcement notices requiring TuHURA to change the way TuHURA uses personal data and/or fines of up to 20 million Euros or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, as well as compensation claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill.

The GDPR may also impose additional compliance obligations relating to the transfer of data between TuHURA and its subsidiaries or other business partners. For example, the European Court of Justice recently**

<div align='center'>34</div>

invalidated the EU-U.S. PrivacyShield as a basis for transfers of personal data from the EU to the U.S. and raised questions about the continued validity of one of the primary alternatives to the EU-U.S. PrivacyShield, namely the European Commission’s Standard Contractual Clauses. Some customers or other service providers may respond to these evolving laws and regulations by asking TuHURA to make certain privacy or data-related contractual commitments that TuHURA is unable or unwilling to make. This could lead to the loss of current or prospective customers or other business relationships. While TuHURA continues to address the implications of the recent changes to EU data privacy regulations, data privacy remains an evolving landscape at both the domestic and international level, with new regulations coming into effect and continued legal challenges, and TuHURA’s efforts to comply with the evolving data protection rules may be unsuccessful. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with TuHURA’s practices. TuHURA must devote significant resources to understanding and complying with this changing landscape. Failure to comply with laws regarding data protection would expose TuHURA to risk of enforcement actions taken by data protection authorities in the EU and elsewhere and carries with it the potential for significant penalties if TuHURA is found to be non-compliant. Similarly,failure to comply with federal and state laws in the United States regarding privacy and security of personal information could expose TuHURA to penalties under such laws. Any such failure to comply with data protection and privacy laws could result in government-imposed fines or orders requiring that TuHURA changes its practices, claims for damages