Company: HCWB
Filing Date: 2025-05-09
Form Type: S-1
Source: 0001193125-25-116745
Chunk: 76

Company: HCW Biologics Inc.
Filing Date: 2025-05-09
Form: S-1
Chunk 76
---
 and state regulators in the event of a breach of
personal information.

Our clinical trial programs and research collaborations outside the United States may implicate international data
protection laws, including in Europe the GDPR. If our privacy or data security measures fail to comply with the GDPR requirements, we may be subject to litigation, regulatory investigations, enforcement notices, and/or enforcement actions requiring
us to change the way we use personal data and/or fines. In addition to statutory enforcement, a personal data breach can lead to negative publicity and a potential loss of business. Further, following the United Kingdom’s withdrawal from the
E.U. effective as of December 31, 2020, we have to comply with the GDPR and the GDPR as incorporated into United Kingdom national law, which may have

45

differing requirements. If we fail to comply with United Kingdom data protection laws, we may be subject to litigation, regulatory investigations, enforcement notices, and/or enforcement actions,
as well as negative publicity and a potential loss of business.

We are also subject to evolving EEA laws on data export, as we may
transfer personal data from the EEA to other jurisdictions. Recent legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States. For example, on July 16, 2020, the
CJEU invalidated the Privacy Shield, under which personal data could be transferred from the EEA to United States entities who had self-certified under the Privacy Shield scheme. Moreover, it is uncertain whether the standard contractual clauses
will also be invalidated by the European courts or legislature.

As government authorities issue further guidance on personal data export
mechanisms and/or start taking enforcement action, we could suffer additional costs, complaints, and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which
we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. These laws and regulations may apply, not
only to us, but also to vendors that store or otherwise process data on our behalf, such as information technology vendors. If such a vendor misuses data we have provided to it, or fails to safeguard such data, we may be subject to litigation,
regulatory investigations, enforcement notices, and/or enforcement actions, as well as negative publicity and a potential loss of business.

Other Risks Related to an Investment in our