Company: ARWR
Filing Date: 2025-11-25
Form Type: 10-K
Source: 0000879407-25-000029
Chunk: 64

Company: ARROWHEAD PHARMACEUTICALS, INC.
Filing Date: 2025-11-25
Form: 10-K
Item: Item 1
Chunk 64
---
 data exporters are required to conduct a transfer risk assessment to verify if anything in the law and/or practices of the third country may impinge on the effectiveness of the SCCs in the context of the transfer at stake and, if so, to identify and adopt supplementary measures that are necessary to ensure compliance with the EU level of protection of personal data. Where no supplementary measure is suitable, the data exporter should avoid, suspend or terminate the transfer. On June 18, 2021, the European Data Protection Board adopted recommendations to assist data exporters with such assessment and their duty to identify and implement supplementary measures where they are needed to ensure compliance with the EU level of protection to the personal data they transfer to third countries. With regard to the transfer of data from the EEA to the US, on July 10, 2023, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework. On the basis of the new adequacy decision, personal data can flow from the EEA to US companies participating in the Data Privacy Framework. With regard to the transfer of data from the EEA to the UK, based on the 

24

European Commission’s adequacy decision of June 28, 2021, personal data may now  flow from the EU to the UK until June 27, 2025. In May 2025, the Commission adopted a decision to extend the validity of such adequacy decision for six more months, from June until December 2025. In July 2025, the Commission issued draft decisions on the extension of the validity of the UK adequacy decisions until December 2031 – if not adopted, as of December 2025, transfer of personal data from the EEA to the UK will be restricted and further measures will have to be implemented to comply with the GDPR.  With respect to transfers from the UK to other countries, these transfers are also subject to specific transfer rules under the UK regime. These UK international transfer rules broadly mirror the EU GDPR rules. On February 2, 2022, the UK Secretary of State laid before the UK Parliament the international data transfer agreement (IDTA) and the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (Addendum) and a document setting out transitional provisions. The IDTA and Addendum came into force on March 21, 2022 and replaced the EU SCCs for the purposes of international transfers under the UK GDPR regime. With regard to the transfer of data from the UK to