Company: AHL
Filing Date: 2025-03-20
Form Type: F-1/A
Source: 0001628280-25-014149
Chunk: 365

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-20
Form: F-1/A
Chunk 365
---
acy decision in relation to the DPF on July 10, 2023, rendering the DPF effective as an E.U. GDPR transfer mechanism to U.S. entities self-certified under the DPF. On October 12, 2023, the U.K. Extension to the DPF came into effect (as approved by the U.K. Government) as a U.K. GDPR data transfer mechanism to U.S. entities self-certified under the U.K. Extension to the DPF. We currently rely on the E.U. standard contractual clauses and the U.K. Addendum to the EU standard contractual clauses and the U.K. International Data Transfer Agreement, as relevant, to transfer personal data outside the EEA and the U.K. with respect to both intragroup and third party transfers. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the DPF adequacy decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by E.U. regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement revised standard contractual clauses for existing intragroup, customer and vendor arrangements within required time frames; and/or it could otherwise affect the manner in which we provide our services, and could adversely affect our business, operations and financial condition.

<div align='center'>239</div>

Table of C ontents

On January 17, 2025, the E.U. Digital Operational Resilience Act (“DORA”) entered into effect. DORA applies to “financial entities” including: (i) insurance and reinsurance undertakings, and insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries and (ii) ICT third-party service providers to financial entities. DORA imposes regulatory obligations to reinforce the digital operational resilience of entities operating in the financial services industry, and to adequately manage and remediate risks related to the engagement of ICT third-party service providers. In addition to financial entities, DORA only imposes direct regulatory obligations on ICT third-party service providers that are considered “critical” within the meaning of DORA. Non-critical ICT third-party service providers are only indirectly impacted by DORA, by virtue of the mandatory contractual terms that DORA requires financial entities to implement with