Company: RPID
Filing Date: 2025-08-12
Form Type: 10-Q
Source: 0001380106-25-000174
Chunk: 47

Company: RAPID MICRO BIOSYSTEMS, INC.
Filing Date: 2025-08-12
Form: 10-Q
Item: Part I, Item 2
Chunk 47
---
EA; or (b) the activities of any of our establishments in the UK or any EEA Member State, such as our German subsidiary. In this Quarterly Report on Form 10-Q, references to “GDPR” encompass both the EU GDPR and UK GDPR, unless specific otherwise. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including  requiring disclosures to individuals regarding data processing activities, requiring that safeguards are implemented to protect the security and confidentiality of personal data, limiting retention periods for personal data, creating mandatory data breach notification requirements in certain circumstances, and requiring that certain measures (including contractual requirements) are put in place when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside the EEA or the U.K., including transfers of personal data from Europe to the United States in certain circumstances. Any inability to transfer personal data from Europe to the United States in compliance with data protection laws may impede our operations and may adversely affect our business and financial position. Switzerland has also 

59

implemented data protection laws with similar obligations and triggers to the GDPR which we may be subject to in connection with our Swiss subsidiary, personnel and customers.

The complex and evolving nature of data protection laws and regulations may lead to additional compliance costs, including as a result of diverging international data privacy laws and regulations and related uncertainties. There can be no assurances that we will be successful in our efforts to comply with the multitude of U.S., state, federal, and foreign privacy and data security laws, and violations of such laws could result in regulatory investigations and significant fines, as well as civil claims including class actions, and reputational damage.

Regulators and legislators in the U.S. are increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries. For example, the Department of Justice Rule, implemented as of January 8, 2025, on Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, prohibits data brokerage transactions involving certain sensitive personal data categories, including health data, genetic data, and biospecimens, to countries of concern, including China. The regulations also restrict certain investment agreements, employment agreements and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls. Actual or alleged violations of these regulations may be punishable by criminal and/or civil sanctions, and may result in exclusion from participation in federal and state programs.

Like many companies, we use artificial intelligence and machine learning (AI