Company: AHL
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001267395-25-000019
Chunk: 127

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-19
Form: 20-F
Item: Item 4
Chunk 127
---
 - Other Operational Risks - Compliance with ever evolving national, federal, state, and international laws relating to the handling of information collected from or about individuals involves significant expenditure and resources, and any failure by us or our vendors to comply may result in significant liability, negative publicity and/or an erosion of trust, which could materially adversely affect our business, results of operations and financial condition.”

In addition, Brexit has implications for transfers of personal data between the UK and the EEA and vice versa. Transfers of personal data from the U. K. to the EEA and vice versa are unrestricted and do not require additional safeguards since the EEA has formally declared the UK’s data protection regime as “adequate” and similarly the UK has formally approved the adequacy of the EU. As a result, transfers of personal data from the EEA to the UK, and vice versa, remain unrestricted and do not require any additional safeguards. The duration of the current adequacy decision will expire on June 27, 2025, at which point the European Commission can decide whether to extend the adequacy decision for a further period up to a maximum of another four years.

E. U./U. K. Cybersecurity and Privacy Laws and Regulations. The E. U. GDPR and U. K. GDPR (together referred to as the “ GDPR”) impose comprehensive data privacy compliance obligations in relation to our collection, processing, sharing, disclosure, transfer and other use of personal data including a principal of accountability and the obligation to demonstrate compliance through policies, procedures, training and audits.

In addition, some of the personal data we process in respect to individual customers, policy holders or beneficiaries is special category or sensitive personal data under the GDPR, and subject to additional compliance obligations and to local law derogations. We may be subject to diverging requirements under E. U. member state laws and U. K. law, such as whether consent can be used as the legal basis for processing. As these laws develop, we may need to make operational changes to adapt to these diverging rules, which could increase our costs and adversely affect our business.

Failure to comply with the GDPR could result in penalties for noncompliance. Since we are potentially subject to the supervision of various EU Member State/UK data protection authorities under both the E. U. GDPR and the U. K. GDPR, it is not excluded that we are faced with enforcement action in various EU/UK jurisdictions. Penalties for certain breaches are up to the greater of EUR 20 million/GBP