Company: NCNA
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0000950170-25-042709
Chunk: 33

Company: NuCana plc
Filing Date: 2025-03-20
Form: 20-F
Item: Item 3
Chunk 33
---
 record-keeping obligations; transparency obligations for data controllers; the obligation to carry out ‘data protection impact assessments’ in certain circumstances; rights for data subjects (such as rights for individuals to be “forgotten”, rights to data portability, rights to object etc.); a stringent standard of data subject consent; and the obligation to notify certain significant personal data breaches to the relevant Supervisory Authority(ies) and affected individuals. In addition, the GDPR provides a very broad definition of what constitutes personal data (for example, the GDPR expressly clarifies that it applies to ‘pseudonymized’ (i.e., key-coded) data). A number of opinions from Supervisory Authorities has further supported a very wide interpretation of the concept of personal data and, thus, the application of the GDPR. Recent decisions by E.U. supervisory authorities and the Court of Justice of the E.U. have confirmed that the rights granted to individuals under the GDPR must be applied broadly, and the law itself must be interpreted strictly, to guarantee the protection of the rights of individuals.
 The GDPR and U.K. GDPR also impose strict rules on the transfer of personal data out of the E.E.A. and United Kingdom to U.S. and other Third Countries. Legal developments in the past five years have created further complexity and uncertainty regarding transfers of personal data from the E.E.A. and United Kingdom to the United States. The E.U.-U.S. Data Privacy Framework, the U.K. Extension to the E.U.-U.S. Data Privacy Framework and the Swiss-E.U. Data Privacy Framework, have made it easier to transfer personal data from the E.E.A., the United Kingdom and Switzerland to the United States (respectively). However, a decision by the Court of Justice of the European Union in January 2025 to award compensation to an individual whose personal data was transferred to the United States demonstrates that this remains a sensitive legal topic. The new U.S. administration may, potentially, offer additional scope to challenge the validity of the Data Privacy Framework under E.U. law.
 As the Data Privacy Framework is limited to transfers to certified participants in the U.S., many transfers continue to rely on the standard contractual clauses. Use of the standard contractual clauses must be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place, however, the nature of these additional measures is currently uncertain. In May 2023,