Company: DNLI
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001714899-25-000193
Chunk: 259

Company: Denali Therapeutics Inc.
Filing Date: 2025-11-06
Form: 10-Q
Item: Part I, Item 4
Chunk 259
---
 we contract with third-party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the EU to the United States and other countries, and in the context of clinical trials we currently rely on patient informed consent as the legal basis for such transfers. In addition, the GDPR provides that EU member states may make their own further laws and regulations limiting the processing of personal data, including genetic, biometric or health data. The GDPR provides for penalties for noncompliance of up to the greater of €20 million or four percent of worldwide annual revenues. The GDPR applies extraterritorially, and we may be subject to the GDPR because of our data processing activities that involve the personal data of individuals located in the EU, such as in connection with any EU clinical trials. Additionally, the UK has implemented legislation that substantially implements the GDPR (the "UK GDPR"), with substantial penalties for noncompliance.

65

Further, various states, such as California, Massachusetts, and Washington have implemented privacy laws and regulations that impose restrictive requirements regulating the use and disclosure of health information and other personal information. Where state laws are more protective than HIPAA, we must comply with the stricter provisions. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. For example, California has enacted legislation, the California Consumer Privacy Act ("CCPA"), which, among other things, requires covered companies to provide new disclosures to California consumers, and affords such consumers new abilities to opt-out of certain sales of personal information. The CCPA, as amended and expanded by the California Privacy Rights Act ("CPRA"), requires covered companies to provide new disclosures to individuals and consumers in California, and afford such individuals and consumers new data protection rights, including the ability to opt-out of certain sales of personal information. Numerous other states in the United States have proposed or enacted similar legislation. Further, some states have enacted more specific legislation, such as Washington's enactment of the My Health, My Data Act, which includes a private right of action. The U.S. federal government is also contemplating federal privacy legislation. Additionally, the U.S. Department of Justice recently implemented a final rule that places limitations, and in some cases prohibitions, on certain transfers of sensitive personal data to business partners located in China or with other specified links to China (and other designated countries). The GDPR, UK GDPR, CCPA, CPRA,