Company: WIT
Filing Date: 2025-05-22
Form Type: 20-F
Source: 0000950170-25-076303
Chunk: 22

Company: WIPRO LTD
Filing Date: 2025-05-22
Form: 20-F
Item: Item 3
Chunk 22
---
 revocation in the interim. The U.K. is considering modifications to its data protection regime that, if implemented, may impact this renewal decision. There also will be increasing scope for divergence in application, interpretation, and enforcement of data protection law between the U.K. and EEA.
Other jurisdictions in which we operate, including China, Singapore, the Philippines, Hong Kong, Canada, and Australia, have enacted robust legal regimes relating to privacy, data protection, and cybersecurity, many of which provide for significant penalties and other sanctions for noncompliance. Certain of these regimes, including, without limitation, the GDPR and U.K. GDPR, provide for restrictions on transferring data outside of those jurisdictions to many other jurisdictions. The regulatory framework relating to cross-border data transfer has evolved significantly in recent years. For example, in 2020, the European Court of Justice (“CJEU”) struck down the EU-U.S. Privacy Shield framework, which provided companies with a mechanism to comply with data protection requirements when transferring personal data from the EEA to the United States (“U.S.”). In the same decision, the CJEU imposed additional obligations on companies when relying on standard contractual clauses approved by the European Commission for use in legitimizing personal data transfers from the EEA to the U.S. The European Commission and U.K. Information Commissioner’s Office since have issued new standard contractual clauses that account for the CJEU’s 2020 decision, with companies relying on that transfer mechanism required to put them in place. Several other laws and regulations enacted in recent years also provide for restrictions on cross-border data transfers, and some of these regimes provide for data localization, under which certain data is required to be maintained within the applicable country. We may be required to take additional steps to address data localization and data transfer issues, including engaging in additional contract negotiations and implementing additional data storage or processing infrastructure, and be subject to increasing costs of compliance and limitations on our customers and us. Additionally, current or modified laws or regulations relating to data transfers and data localization, and related developments, including legal challenges and judicial decisions, may serve as a basis for our data handling practices, or those of our customers and service providers, to be challenged, and may otherwise adversely affect our business, financial condition and results of operations.
In the U.S., privacy laws continue to evolve and could require us to modify our data processing practices and policies and expose us to further regulatory or operational burdens. For example, the California Consumer Privacy Act (“CCPA”), took effect in January 2020. The