Company: SCLXW
Filing Date: 2025-05-14
Form Type: 424B3
Source: 0001193125-25-119831
Chunk: 308

Company: Scilex Holding Co
Filing Date: 2025-05-14
Form: 424B3
Chunk 308
---
 and promotion of our products to the general public
and to health care professionals. Violations of the rules governing the promotion of medicinal products in the EEA could be penalized by administrative measures, fines and imprisonment.

In addition to data privacy and security regulations in the United States, we may be subject to, or our marketing activities may be limited
by, data privacy and security regulations in the EEA, Switzerland, or the United Kingdom (“UK”), where the legislative and regulatory landscape continues to evolve. There has been increased regulator attention to privacy and data security
issues that could potentially affect our business, including through legislation such as the EEA General Data Protection Regulation (“EEA GDPR”) and UK General Data Protection Regulation (“UK GDPR,” and together, the
“GDPR”), which each imposes strict obligations on the processing of personal data, including the transfer of personal data from the EEA, Switzerland, or UK to third countries that the European Commission has determined does not ensure an
adequate level of protection, such as the United States. If we violate the GDPR, we may face significant penalties of up to EUR 10,000,000 or 2% of our total worldwide annual turnover, or for more serious violations, up to EUR 20,000,000 or 4% of
our total worldwide annual turnover.

The GDPR and other EEA and UK data privacy and security regulations generally restrict the transfer
of personal data from the EEA, United Kingdom and Switzerland, to the United States and certain other third countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. One of the
primary safeguards on which companies may rely to import or export personal data from had been the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield frameworks
administered by the U.S. Department of Commerce. However, the EU-U.S. Privacy Shield was invalidated in July 2020 by the Court of Justice of the European Union (the “CJEU”) in a case known as
“Schrems II.” Following this decision, the Swiss Federal Data Protection and Information Commissioner (the “FDPIC”) announced that the Swiss-U.S. Privacy Shield does not provide
adequate safeguards for the purposes of personal data transfers from Switzerland to third countries that are deemed as not providing adequate protection, including the United States. While the FDPIC does not have authority to invalidate the Swiss-U.S. Privacy Shield regime, the FDPIC’s announcement casts doubt on the viability of the