Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 942

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 942
---
 EEA to the US under the EU-U.S. Data Privacy Framework (followed on 12 October 2023, with the adoption of an adequacy decision in the UK for the UK-US Data Bridge). However, the adequacy decision does not foreclose, and is likely to face, future legal challenges and the ongoing legal uncertainty may increase our costs and our ability to efficiently process personal data from the EEA or the UK. In addition to the ongoing legal uncertainty with respect to data transfers from the EEA or the UK, additional costs may need to be incurred in order to implement necessary safeguards to comply with the GDPR and the UK GDPR and potential new rules and restrictions on the flow of data across borders could increase the cost and complexity of conducting business in some markets. If our policies and practices or those of our vendors are, or are perceived to be, insufficient, or if our users have concerns regarding the transfer of data from the EEA or the UK to the US, we could be subject to enforcement actions or investigations by individual EU or UK data protection authorities or lawsuits by private parties.

Additionally, the EU adopted Regulation (EU) 2022/2554, or the Digital Operational Resilience Act (DORA), in November 2022, which became effective from 17 January 2025. DORA, which applies as lex specialis for the financial sector regarding cybersecurity, aims to achieve a common level of digital operational resilience as well as consolidate and upgrade existing Information Communication Technologies (ICT) risk requirements that had been addressed separately in different regulations and directives, such as Directive (EU) 2022/2555 (otherwise known as the NIS 2 Directive). DORA establishes a set of uniform requirements for network and information systems security structured in five pillars: (i) ICT risk management and governance, (ii) ICT-related incident management, classification and reporting, (iii) digital operational resilience testing, (iv) management of third-party ICT risk, and (v) information and intelligence sharing.

In the US, there are numerous federal, state and local privacy, data protection and cybersecurity laws, rules, regulations and standards governing the collection, sharing, use, retention,

disclosure, protection, transfer and other processing of personal information, including federal and state data privacy laws, data breach notification laws and data disposal laws. For example, at the federal level, among other laws, rules, regulations and standards, we are subject to the Gramm-Leach-Bliley Act (GLBA), which requires financial institutions