Company: GHRS
Filing Date: 2025-07-29
Form Type: 20-F/A
Source: 0001140361-25-027850
Chunk: 87

Company: GH Research PLC
Filing Date: 2025-07-29
Form: 20-F/A
Chunk 87
---
 to impose large penalties for violations of the GDPR, including potential fines of up to EUR 20 million or 4% of annual global revenue, whichever is greater, and up to the greater of GBP 17.5 million or 4% of annual global revenue in the case of noncompliance with the UK GDPR. The GDPR and the UK GDPR also provide individuals with various rights in respect of their personal data, including rights of access, erasure, portability, rectification, restriction and objection, and confer a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR and UK GDPR. The GDPR and UK GDPR requirements apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information. The GDPR and the Irish Data Protection Act 2018 also impose strict rules on the transfer of personal data to countries outside the EEA, including the United States, unless the parties to the transfer have implemented safeguards to protect the transferred personal information. The Court of Justice of the EU, or CJEU, recently raised questions about whether the European Commission’s Standard Contractual Clauses, one of the primary mechanisms used by companies to import personal information from Europe, complies with the GDPR. While the CJEU upheld the validity of the Standard Contractual Clauses, the CJEU ruled that the underlying data transfers must be assessed on a case-by-case basis by the data controller to determine whether the personal information will be adequately protected. Further, the European Commission recently proposed updates to the Standard Contractual Clauses. At present, there are few if any viable alternatives to the Standard Contractual Clauses and there is uncertainty regarding how to ensure that transfers of personal information from Europe to the United States might be adequately protected so as to comply with the GDPR. As such, any transfers by us, or our vendors, of personal information from Europe may not comply with European data protection laws and may increase our exposure to the GDPR’s heightened sanctions for violations of its cross-border data transfer restrictions. Loss of our ability to transfer personal information from the EEA may also require us to increase our data processing capabilities in those jurisdictions at significant expense. Further, the UK’s withdrawal from the EU and EEA on January 31, 2020, has created uncertainty with regard to data protection regulation in the UK. As of January 1, 2021, we are also subject to the UK GDPR and UK Data Protection