Company: PTHS
Filing Date: 2025-09-16
Form Type: 8-K/A
Source: 0001753926-25-001500
Chunk: 78

Company: Pelthos Therapeutics Inc.
Filing Date: 2025-09-16
Form: 8-K/A
Chunk 78
---
 a final rule that went into effect in April 2025, known as the “Data Security Program,” (the “DSP Rule”), which regulates data transactions that could grant access to US sensitive personal data to certain foreign actors with connections to “countries of concern,” such as China, which the DSP refers to as “covered persons.” As supervisory authorities issue further guidance on personal data export mechanisms, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Since the beginning of 2021, after the end of the transition period following the United Kingdom’s departure from the European Union, we are also subject to the United Kingdom General Data Protection Regulation and Data Protection Act 2018 (collectively, the “UK GDPR”), which imposes separate but similar obligations to those under the GDPR and comparable penalties, including fines of up to £17.5 million or 4% of a noncompliant company’s global annual revenue for the preceding financial year, whichever is greater. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government), as a data transfer mechanism to U.S. entities self-certified under the DPF. As we continue to expand into other foreign countries and jurisdictions, we may be subject to additional laws and regulations that may affect how we conduct business. Failure or perceived failure to comply with the GDPR, the UK GDPR, and other countries’ privacy or data security-related laws, rules, or regulations could result in significant regulatory penalties and fines, affect our compliance with contracts entered into with our partners, collaborators and other third-party payors, and could have an adverse effect on our reputation, business, and financial condition.

Furthermore, the Federal Trade Commission (“FTC”) also has authority to initiate enforcement actions against entities that make deceptive statements about privacy and data sharing in privacy policies, fail to limit third-party use of personal health information, fail to implement policies to protect personal health information or engage in other unfair practices that harm customers or that may violate Section 5 of the Federal Trade Commission Act. Failing to take appropriate steps to keep consumers’ personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the