Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 941

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 941
---
 the same obligations as the GDPR, the UK GDPR will not automatically incorporate changes to the GDPR going forward (which would need to be specifically incorporated by the UK government). Moreover, the UK government has publicly announced plans to reform the UK GDPR in ways that, if formalized, are likely to deviate from the GDPR, all of which creates a risk of divergent parallel regimes and related uncertainty, along with the potential for increased compliance costs and risks for affected businesses.

The implementation of the GDPR, UK GDPR and other data protection regimes has required substantial amendments to our procedures and policies. The changes have impacted, and could further adversely impact, our business by increasing our operational and compliance costs. We expect the number of jurisdictions adopting their own privacy, data protection and cybersecurity laws to increase, which will likely require us to devote additional significant operational resources for our compliance efforts and incur additional significant expenses. This legal environment is also likely to increase our exposure to risk of claims alleging non-compliance with all applicable privacy, data protection and cybersecurity laws, rules, regulations and standards.

Recent legal developments in the EEA, including recent rulings from the Court of Justice of the European Union and from

| 896 |

| Contents |     | Cross-reference to Form 20-F |     | Consolidated director's report |     | Consolidated financial statements |     | Supplemental information |

various EU member state data protection authorities, have created complexity and uncertainty regarding transfers of personal data from the EEA to the US and other so-called third countries outside the EEA. While we have taken steps to mitigate the impact on us, such as implementing the SCCs, the efficacy and longevity of these mechanisms remain uncertain. Although the UK currently has an adequacy decision from the European Commission, such that SCCs are not required for the transfer of personal data from the EEA to the UK, that decision will sunset on 27 June 2025 unless extended and it may be revoked in the future by the European Commission if the UK data protection regime is reformed in ways that deviate substantially from the GDPR. Adding further complexity for international data transfers, in March 2022, the UK adopted its own International Data Transfer Agreement for transfers of personal data out of the UK to so-called third countries, as well as an international data transfer addendum that can be used with the SCCs for the same purpose. Moreover, on 10 July 2023, the European Commission adopted an adequacy decision concluding that the US ensures an adequate level of protection for personal data transferred from the