Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 940

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 940
---
 broader financial system have significantly increased in recent years, privacy, data protection and cybersecurity issues have become the subject of increasing legislative and regulatory focus. Internationally, virtually every jurisdiction in which we operate has established its own privacy, data protection and cybersecurity legal and regulatory framework with which we must comply. For example, on 25 May 2018, the Regulation (EU) 2016/279 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to

the processing of personal data and on the free movement of such data (the General Data Protection Regulation or GDPR) became directly applicable in all member states of the EU. To align the Spanish legal regime with the GDPR, Spain enacted the Organic Law 3/2018, of 5 December, on Data Protection and the safeguarding of digital rights which repealed the Spanish Organic Law 15/1999, of 13 December, on Data Protection. Additionally, following the UK’s withdrawal from the EU, we also are subject to the UK General Data Protection Regulation (UK GDPR) (i.e., a version of the GDPR as implemented into UK law). Although a number of basic existing principles have remained the same, the GDPR and UK GDPR introduced extensive new obligations on both data controllers and processors, as well as rights for data subjects. The GDPR and UK GDPR, together with national legislation, regulations and guidelines of the EU member states governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, use, retain, protect, disclose, transfer and otherwise process personal data. In particular, the GDPR and UK GDPR include obligations and restrictions concerning the security and confidentiality of personal data, such as obtaining consent from the individuals to whom the personal data relates for certain processing activities, using safeguards on transfers of personal data out of the EEA and the UK, respectively, and making notifications with respect to certain security breaches, among others. The GDPR and UK GDPR also impose significant fines and penalties for non-compliance of up to the higher of 4% of annual worldwide turnover or EUR 20 million (or GBP 17.5 million under the UK GDPR) and, for other specified infringements, fines and penalties of up to the higher of 2% of annual worldwide turnover or EUR 10 million (or GBP 8.7 million under UK GDPR). European data protection authorities have already imposed fines for GDPR violations up to, in some cases, hundreds of millions of euros. While the UK GDPR currently imposes substantially