Company: WIT
Filing Date: 2025-05-22
Form Type: 20-F
Source: 0000950170-25-076303
Chunk: 21

Company: WIPRO LTD
Filing Date: 2025-05-22
Form: 20-F
Item: Item 3
Chunk 21
---
For example, the EU has adopted the General Data Protection Regulation (“GDPR”), which went into effect in May 2018, and together with national legislation, regulations and guidelines of the EU member states, contains numerous requirements relating to the processing of personal data of EU data subjects, including the increased jurisdictional reach of the European Commission, more robust obligations, additional requirements for data protection compliance programs by companies, and significantly increased fines and penalties and rights for data subjects to claim compensation. EU member states are tasked under the GDPR to enact, and have enacted, certain legislation that adds to or further interprets the GDPR requirements and potentially extends our obligations and potential liability for failing to meet such obligations. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to countries outside the European Economic Area (“EEA”) that have not been found to provide adequate protection to such personal data. The GDPR also introduced numerous privacy-related changes for companies operating in the EU, including greater control for data subjects (for example, the “right to be forgotten”), increased data portability for EU consumers, data breach notification requirements and increased fines. In particular, under the GDPR, fines of up to 20 million euros or 4% of the annual global revenue of the noncompliant company, whichever is greater, could be imposed for violations of certain of the GDPR’s requirements. Such penalties are in addition to any civil litigation claims by customers and data subjects.

 --

The EU also has enacted directives and regulations addressing cybersecurity. For example, the Network and Information Security Directive II (“NIS2”), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the EU. It expands the scope of the 2016 NIS Directive to include additional sectors while enforcing stricter governance and accountability requirements. Additionally, the Digital Operational Resiliency Act became effective in January 2025, and aims to establish a universal framework for managing and mitigating information and communication technology risk that will apply to entities in the financial sector and their third-party cloud service providers.
Data processing in the U.K. is governed by a U.K. version of the GDPR (combining the GDPR and the Data Protection Act 2018) (“U.K. GDPR”), with fines and enforcement mechanisms similar to those of the GDPR. In 2021, the European Commission issued an adequacy decision, pursuant to which personal data generally may be transferred from the EU to the U.K. without restriction; however, this adequacy decision must be renewed and is subject to modification or