Company: ATHE
Filing Date: 2025-08-29
Form Type: 20-F
Source: 0001213900-25-082027
Chunk: 17

Company: ALTERITY THERAPEUTICS LTD
Filing Date: 2025-08-29
Form: 20-F
Item: Item 3
Chunk 17
---
 General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”)(collectively, “GDPR”), Brazil’s General Data Protection Law (Lei Geral de Protecão de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing personal data. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions, fines of up to 20 million Euros / 17.5 million pounds sterling, or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. China’s PIPL imposes a set of specific obligations on covered businesses in connection with their processing and transfer of personal data and imposes fines of up to RMB 50 million or 5% of the prior year’s total annual revenue of the violator. In Canada, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and various related provincial laws, as well as Canada’s Anti-Spam Legislation (“CASL”), may apply to our operations. We may be subject to new and emerging data privacy and security regimes, including Australia’s Privacy Act, China’s Personal Information Protection Law, Japan’s Act on the Protection of Personal Information, and Singapore’s Personal Data Protection Act.

10

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (“EEA”) and the United Kingdom (“UK”) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can