Company: HURA
Filing Date: 2025-05-23
Form Type: 424B3
Source: 0001193125-25-125499
Chunk: 138

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-05-23
Form: 424B3
Chunk 138
---

outside resources. In addition, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. In addition to the risks associated with
enforcement activities and potential contractual liabilities, TuHURA’s ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to its policies, procedures and
systems.

In the EU, TuHURA may be subject to the General Data Protection Regulation (“GDPR”) which went into effect in May 2018
and which imposes obligations on companies that operate in TuHURA’s industry with respect to the processing of personal data and the cross-border transfer of such data. The GDPR imposes onerous accountability obligations requiring data
controllers and processors to maintain a record of their data processing and policies. If TuHURA’s or TuHURA’s partners’ or service providers’ privacy or data security measures fail to comply with the GDPR requirements, TuHURA
may be subject to litigation, regulatory investigations, enforcement notices requiring TuHURA to change the way TuHURA uses personal data and/or fines of up to 20 million Euros or up to 4% of the total worldwide annual turnover of the preceding
financial year, whichever is higher, as well as compensation claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill.

The GDPR may also impose additional compliance obligations relating to the transfer of data between TuHURA and its subsidiaries or other
business partners. For example, the European Court of Justice recently invalidated the EU-U.S. Privacy Shield as a basis for transfers of personal data from the EU to the U.S. and raised questions about the
continued validity of one of the primary alternatives to the EU-U.S. Privacy Shield, namely the European Commission’s Standard Contractual Clauses. Some customers or other service providers may respond to
these evolving laws and regulations by asking TuHURA to make certain privacy or data-related contractual commitments that TuHURA is unable or unwilling to make. This could lead to the loss of current or prospective customers or other business
relationships.

While TuHURA continues to address the implications of the recent changes to EU data privacy regulations, data privacy
remains an evolving landscape at both the domestic and international level, with new regulations coming into effect and continued legal challenges, and TuHURA’s efforts to comply with the evolving data protection rules may be unsuccessful. It
is possible that these laws may be interpreted and