Company: GLPG
Filing Date: 2025-03-27
Form Type: 20-F
Source: 0001558370-25-003806
Chunk: 164

Company: GALAPAGOS NV
Filing Date: 2025-03-27
Form: 20-F
Item: Item 4
Chunk 164
---
The General Data Protection Regulation (EU) 2016/679 (EU GDPR) and the UK General Data Protection Legislation (UK GDPR) regulate the collection and use of personal data in connection with the EU and UK respectively. These regulations operate alongside applicable data protection laws in effect in the EU Member States and in the UK, including the UK Data Protection Act 2018, which further govern the processing of personal data. Unless stated otherwise, references to the GDPR in this annual report, encompass both the EU GDPR and UK GDPR. The GDPR applies to any business, regardless of its location, if it processes personal data in connection with (a) offering goods or services to individuals in the EU/UK, or monitoring their behavior; or (b) in the context of the activities of an establishment in the EU/UK. Accordingly the GDPR may apply to our activities in the EU/UK. The GDPR imposes strict requirements on controllers and processors of personal data, including special protections for “sensitive information,” which includes health and genetic information of individuals in the EU/UK. The GDPR grants individuals the opportunity to object to the processing of their personal data, allows them to request deletion of personal data in certain circumstances, and provides the individual with an express right to seek legal remedies in the event the individual believes his or her rights have been violated. Further, the GDPR imposes strict rules on the transfer of personal data out of the EU to regions that have not been deemed to offer “adequate” privacy protections, such as the U.S. in certain circumstances. Failure to comply with the requirements of the GDPR and the related national data protection laws of the EU Member States/the UK, which may deviate slightly from the GDPR, may result in warning letters, mandatory audits, suspension of processing and financial penalties, including fines of up to 4 percent of global revenues, or €20,000,000 (£17.5 million for the UK GDPR), whichever is greater. We may be required to put in place additional mechanisms to ensure compliance with the GDPR. Following the UK’s decision to leave the EU on January 31, 2020, the UK’s data protection regime is independent from but aligned to the EU’s data protection regime. However, the UK government is planning to reform its data protection law with the Data (Use and Access) Bill, which it introduced to Parliament on October 24, 2024. These potential future changes to UK data protection laws may alter the similarities between the UK and EU data protection regime. Data protection authority activity differs