Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 1014

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 1014
---
 Commission if the UK data protection regime is reformed in ways that deviate substantially from the GDPR. Adding further complexity for international data transfers, in March 2022, the UK adopted its own International Data Transfer Agreement for transfers of personal data out of the UK to so-called third countries, as well as an international data transfer addendum that can be used with the SCCs for the same purpose. Moreover, on 10 July 2023, the European Commission adopted an adequacy decision concluding that the US ensures an adequate level of protection for personal data transferred from the EEA to the US under the EU-U.S. Data Privacy Framework (followed on 12 October 2023, with the adoption of an adequacy decision in the UK for the UK-US Data Bridge). However, the adequacy decision does not foreclose, and is likely to face, future legal challenges and the ongoing legal uncertainty may increase our costs and our ability to efficiently process personal data from the EEA or the UK. The implementation of the GDPR, UK GDPR and other data protection regimes has required substantial amendments to Banco Santander’s procedures and policies, which have impacted, and could further adversely impact, Banco Santander’s business by increasing its operational and compliance costs.

Additionally, the EU adopted DORA, in November 2022, which will be effective from 17 January 2025. DORA, which will apply as lex specialis for the financial sector regarding cybersecurity, aims to achieve a common level of digital operational resilience as well as consolidate and upgrade existing ICT risk requirements that had been addressed separately in different regulations and directives, such as Directive (EU) 2022/2555 (otherwise known as the NIS 2 Directive). DORA establishes a set of uniform requirements for network and information systems security structured in five pillars: (i) ICT risk management and governance, (ii) ICT-related incident management, classification and reporting, (iii) digital operational resilience testing, (iv) management of third-party ICT risk, and (v) information and intelligence sharing. The financial sector faces risks and uncertainties regarding the implementation of DORA given that it has stringent compliance timelines. The final technical standards were released in July 2024.

We expect the number of jurisdictions adopting their own privacy, data protection and cybersecurity laws, regulations, rules and standards to increase, which will require us to devote additional significant operational resources and incur additional significant expenses and will also increase our exposure to risks of claims alleging non-compliance with all applicable privacy, data protection and cybersecurity laws