Company: NCEL
Filing Date: 2025-05-16
Form Type: 20-F
Source: 0001213900-25-044868
Chunk: 124

Company: NewcelX Ltd.
Filing Date: 2025-05-16
Form: 20-F
Item: Item 3
Chunk 124
---
 or other data security incidents, could significantly disrupt the combined company’s operations.

The combined company’s
operations depend, in part, on the continued performance of its information technology systems. The combined company’s information
technology systems are potentially vulnerable to physical or electronic break-ins, computer viruses and similar disruptions. Failure of
its information technology systems could adversely affect its business, profitability and financial condition. Although the combined company
has information technology security systems, a successful cybersecurity attack or other data security incident could result in the misappropriation
and/or loss of confidential or personal information, create system interruptions, or deploy malicious software that attacks its systems.
It is possible that a cybersecurity attack might not be noticed for some period of time. The occurrence of a cybersecurity attack or incident
could result in business interruptions from the disruption of the combined company’s information technology systems, or negative
publicity resulting in reputational damage with its shareholders and other shareholders and/or increased costs to prevent, respond to
or mitigate cybersecurity events. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could
result in delays in its regulatory approval efforts and significantly increase its costs to recover or reproduce the data. In addition,
the unauthorized dissemination of sensitive personal information or proprietary or confidential information could expose the combined
company or other third parties to regulatory fines or penalties, litigation and potential liability, or otherwise harm its business.

Unsuccessful compliance with certain European
privacy regulations could have an adverse effect on the combined company’s business and reputation.

The collection and use
of personal health data in the EU is governed by the provisions of the data protection derivative and the GDPR. These
directives impose several requirements relating to the consent of the individuals to whom the personal data relates, the information
provided to the individuals, notification of data processing obligations to the competent national data protection authorities and
the security and confidentiality of the personal data. The GDPR also extends the geographical scope of EU data protection law to
non-EU entities under certain conditions, tightens existing EU data protection principles and creates new obligations for companies
and new rights for individuals. Failure to comply with the requirements of the Data Protection Directive, the GDPR, and the related
national data protection laws of the EU Member States may result in fines and other administrative penalties. The GDPR introduces
new data protection requirements in the EU and substantial fines for breaches of the data protection rules. The GDPR regulations
impose additional responsibility and liability in relation to personal data that the combined company processes and the combined
company intends to