Company: GHRS
Filing Date: 2025-07-29
Form Type: 20-F/A
Source: 0001140361-25-027850
Chunk: 211

Company: GH Research PLC
Filing Date: 2025-07-29
Form: 20-F/A
Chunk 211
---
20 million or 4% of annual global revenue, and up to the greater of GBP 17.5 million or 4% of annual global revenue in the case of noncompliance with the UK GDPR. The GDPR increases our responsibility and liability in relation to personal data that we process where such processing is subject to the GDPR, and we may be required to put in place additional mechanisms to ensure compliance with the GDPR, including as implemented by individual countries. The UK has legislation equivalent to GDPR, and while the European Commission issued an adequacy decision on June 28, 2021, enabling data transfers from EU member states to the UK to continue without requiring organizations to put in place contractual or other measures in order to lawfully transfer personal data between the territories, it remains unclear how data transfers to and from the UK will be regulated in the long term. Compliance with the GDPR and the UK GDPR is a rigorous, costly and time-intensive process that will increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm in connection with our European personal data processing activities. 125 Table of Contents In the United States, numerous federal and state laws and regulations, including state data breach notification laws, state health and personal information privacy laws, and federal and state consumer protection laws, govern the collection, use, processing, storage, transmission, disclosure, destruction and protection of health-related and other personal information. For example, the California Consumer Privacy Act of 2018, or CCPA, became effective on January 1, 2020, and creates new individual privacy rights for California consumers and places increased privacy and security obligations on entities handling certain personal data of California consumers. The CCPA requires companies subject to the legislation to provide new disclosure to consumers about such companies’ data collection, use and sharing practices and provide such consumers new ways to opt-out of certain sales or transfers of personal information. The CCPA provides for civil penalties as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. In addition, the California Privacy Rights Act of 2020, or CPRA, went into effect on January 1, 2023. The CPRA, among other things, gives California residents the ability to limit the use of their personal information, further restricts the use of cross-context