Company: ARWR
Filing Date: 2025-11-25
Form Type: 10-K
Source: 0000879407-25-000029
Chunk: 62

Company: ARROWHEAD PHARMACEUTICALS, INC.
Filing Date: 2025-11-25
Form: 10-K
Item: Item 1
Chunk 62
---
 consumers (which is defined to include business representatives and employees) who are California residents, imposes obligations on certain businesses that do business in California, including to provide specific disclosures in privacy notices, and affords rights to California residents in relation to their personal information. Health information falls under the CCPA/CPRA’s definition of personal information where it identifies, relates to, describes, is reasonably capable of being associated with or could reasonably be 

23

linked, directly or indirectly, with a particular consumer or household and is considered “sensitive personal information,” which is offered greater protection. However, the CCPA/CPRA, like other U.S. state privacy laws, does not apply to PHI, and most other U.S. state laws exempt covered entities and business associates altogether. Some of these laws and regulations impose different, and in certain instances, more stringent requirements than HIPAA. Failing to comply with these laws and regulations can result in significant civil and/or criminal penalties, as well as, in some cases, exposure to private litigation, all of which can result in financial and reputational risks.

The processing of personal data, including health-related personal data, in the EEA is mainly governed by the provisions of the European General Data Protection Regulation (EU) 2016/679 (“GDPR”),  and by data protection related national laws, which supplement, interpret, and in some cases go beyond the GRDP. In the UK, the processing of personal data is mainly governed by the GDPR as incorporated into UK law pursuant to the European Union (Withdrawal) Act 2018 (the “UK GDPR”). Compliance with the GDPR and UK GDPR requirements has a number of significant practical consequences, including for international data transfers and enforcement of the GDPR by competent data protection authorities. The GDPR and UK GDPR imposed specific responsibility and liability in relation to personal data that we process, particularly when we act as a controller.  

The GDPR and UK GDPR imposes a number of strict obligations and restrictions on the ability to process (processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, storage, use and transfer of) personal data of individuals in the EEA, including health data from clinical trials and adverse event reporting. The GDPR and UK GDPR also includes requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals prior to processing their personal data (including health data), data breach notification obligations to the national data protection authorities