Company: IMCR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001671927-25-000006
Chunk: 164

Company: Immunocore Holdings plc
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 164
---
 we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. 

86

Table of Contents

The legislative and regulatory landscape for privacy and data protection continues to evolve in jurisdictions worldwide, and there has been an increasing focus on privacy and data protection issues. Our obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions. Preparation for and compliance with these obligations requires us to devote significant resources (including, without limitation, financial and time-related resources) to it. These obligations may necessitate changes to our business including our information technologies, systems and practices and to those of any third parties that process personal data on our behalf. Although we take efforts designed to comply with applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations. If we (or third parties upon which we rely) fail, or are perceived to have failed, to address and comply with data privacy and security obligations, we could face significant consequences. These consequences may include but are not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections and similar consequences); litigation (including class-related claims) and mass arbitration; additional reporting requirements and oversight; bans on processing personal data; orders to destroy and not to use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation and our business and financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations (including, our clinical trial activities); inability to process personal data; inability to operate in specific jurisdictions; limitations in our ability to develop and commercialize our products; time and other resource expenditures; adverse publicity; and revisions to our operations.

Obtaining and maintaining regulatory approval of our product candidates in one jurisdiction does not mean that