Company: GLPG
Filing Date: 2025-03-27
Form Type: 20-F
Source: 0001558370-25-003806
Chunk: 67

Company: GALAPAGOS NV
Filing Date: 2025-03-27
Form: 20-F
Item: Item 3
Chunk 67
---
 requirements for securing personal data, mandatory data breach notification requirements, appointing data protection officers, conducting data protection impact assessments, and has created onerous liabilities on controllers and processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside of the UK and EEA that do not ensure an adequate level of protection, including the United States in certain circumstances, unless derogation exists or a valid GDPR transfer mechanism (for example, the European Commission approved Standard Contractual Clauses, or SCCs, and the UK International Data Transfer Agreement or Addendum, or the UK IDTA), have been put in place and transfer impact assessments increases substantially the penalties to which we could be subject in carried out. Any inability to transfer personal data from the UK or EEA to the United States in compliance with data protection laws may impede our operations and may adversely affect our business and financial position. Following the UK’s exit from the EU, or Brexit, there will be increasing scope for divergence in application, interpretation and enforcement of the data protection laws between these territories. For example, the UK has introduced the Data Reform Bill into the UK legislative process with the intention for this bill to reform the UK’s data protection regime following Brexit. If passed, the final version of the Data Reform Bill may have the effect of further altering the similarities between the UK and EEA data protection regimes and threaten the UK adequacy decision from the EU Commission allowing the free flow of personal data from the UK to the EEA, which may lead to additional compliance costs and could increase our overall risk. This lack of clarity on future UK laws and regulations and their interaction with those of the EEA could add legal risk, uncertainty, complexity, and cost to our handling of EEA and UK personal data and our privacy and security compliance programs, and could require us to implement different compliance measures for the UK and EEA.
​
Failure to comply with the requirements of the GDPR and the related national data protection laws of the EEA member states and the UK, which may deviate slightly from the GDPR, may result in warning letters, mandatory audits, suspension of processing and substantial financial penalties, including possible fines of up to € 20,000,000 (17.5 million for the UK GDPR) or up to 4% of our total worldwide annual turnover of the preceding year for the most serious infringements. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for