Company: BDRX
Filing Date: 2025-01-17
Form Type: F-1
Source: 0001214659-25-000922
Chunk: 73

Company: Biodexa Pharmaceuticals Plc
Filing Date: 2025-01-17
Form: F-1
Chunk 73
---
 laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and our clients and potentially exposing us to additional expense, adverse publicity and liability. Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify.

In the European Union, the General Data Protection Regulation (EU) 2016/679, or GDPR, lays down the legal framework for data protection and privacy. The GDPR applies directly in all European Union member states (until December 31, 2020, this included the United Kingdom) and applies to companies with an establishment in the European Economic Area, or EEA, and to certain other companies not in the EEA that process personal data in relation to offering or providing goods or services to individuals located in the EEA, or monitor the behavior of individuals located in the EEA. In the United Kingdom, the GDPR has been implemented into United Kingdom domestic law, pursuant to the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (as amended), which makes some minor technical amendments to ensure the GDPR is operable in the United Kingdom, or the UK GDPR. The UK GDPR is also supplemented by the Data Protection Act 2018. United Kingdom and European Union data protection law is therefore aligned. The GDPR and UK GDPR implement stringent operational requirements for both controllers and processors of personal data, including, for example, expanded disclosures about how personal information is to be used, limitations on retention of information, increased requirements pertaining to health data and pseudonymized (i.e., key-coded) data, increased cyber security requirements, new rights for individuals to be “forgotten” and rights to data portability, as well as enhanced current rights (e.g., access requests), mandatory data breach notification requirements and higher standards for controllers to demonstrate that they have obtained a valid legal basis for certain data processing activities. In particular, medical or health data, genetic data and biometric data are all classified as “special category” data under the GDPR and the UK GDPR, and afforded greater protection and require additional compliance obligations. Further, the GDPR provides that European Union member states may make their own further laws and regulations in relation to the processing of genetic, biometric or health data, which could result in differences between member states, limit our ability to use and share personal data or could cause our costs to increase, and harm our business and financial condition.