Company: TAK
Filing Date: 2025-06-25
Form Type: 20-F
Source: 0001395064-25-000095
Chunk: 30

Company: TAKEDA PHARMACEUTICAL CO LTD
Filing Date: 2025-06-25
Form: 20-F
Item: Item 3
Chunk 30
---
 rules and determined that top-up taxes may be applicable in some jurisdictions in which we operate. For example, for the year ended March 31, 2025 we reported a Pillar Two tax expense of JPY 0.3 billion.

Changes in data privacy and protection laws and regulations or any failure to comply with such laws and regulations, could adversely affect our business and financial results.

We are subject to laws and regulations globally regarding privacy, data protection, and data security, including those related to the collection, storage, handling, use, disclosure, transfer, and security of personal data. Significant uncertainty exists as these laws vary across jurisdictions potentially leading to inconsistent or conflicting requirements. For example, the EU’s General Data Protection Regulation (the “ GDPR”) imposes significant data protection obligations on companies regarding the handling of personal data and provides individuals with heightened privacy rights. EU regulators have increasingly imposed significant fines under the GDPR for non-compliant organizations reaching up to the higher ofEUR 20 million or 4% o f annual global turnover for the most serious breaches. Following the GDPR’s regulatory model several countries have enacted enhanced privacy laws and cross-border data transfer restrictions, including Brazil, Canada, China, India, Japan, Russia, Singapore and the U. S. For example, a U. S. Department of Justice rule implementingExecutive Order 14117, issued in December 2024, restricts certain types and quantities of sensitive U. S. personal data or government-related data transactions with countries of concern, and imposes burdensome due diligence and reporting requirements. The U. S is also seeing a continued expansion of state-level privacy laws and enforcement actions, adding to the growing complexity of compliance in navigating an increasingly fragmented landscape of state regulations. Another example is the recent expansion of onerous cross-border transfer restrictions and obligations from countries and regions such as China, Brazil, Latin-America, Saudi Arabia and Turkey.

The increased use of digital technologies involving personal data, such as mobile health apps, wearables, digitalization of clinical trials or AI tools deployed on personal data pose additional risks for our company due to the larger volume of personal data we handle, potential security threats of such technology, and our ability to assess the deployment of each technology because of the volume and speed at which they are being developed. Compliance with existing, proposed and recently enacted laws and regulations can be costly and failure to comply could subject us to legal and reputational risks. We have also observed an increase in cyber-attacks targeting health information. See“ - Risks Relating to Our