Company: DNLI
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001714899-25-000105
Chunk: 337

Company: Denali Therapeutics Inc.
Filing Date: 2025-05-06
Form: 10-Q
Item: Part II, Item 1A
Chunk 337
---
 otherwise process significant and increasing volumes of sensitive information and business-critical information, including employee and personal data (including protected health information), research and development information, commercial information, and business and financial information. We heavily rely on external security and infrastructure vendors to manage our information technology systems and data centers. We face a number of risks relative to protecting this critical information, including the loss of access, inappropriate use or disclosure, inappropriate modification, and the risk of our being unable to adequately monitor, audit, and modify our controls over our critical information. This risk extends to third-party vendors and subcontractors we use to manage this sensitive data.

A wide variety of provincial, state, national, and international laws and regulations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of data relating to individuals. These laws and regulations are evolving and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, the collection and use of personal data in the EU are governed by the EU General Data Protection Regulation ("GDPR"), which became fully effective on May 25, 2018. The GDPR imposes stringent data protection requirements, including, for example, more robust disclosures to individuals and a strengthened individual data rights regime, shortened timelines for data breach notifications, limitations on retention of information, increased requirements pertaining to special categories of data, such as health data, and additional obligations when we contract with third-party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the EU to the United States and other countries, and in the context of clinical trials we currently rely on patient informed consent as the legal basis for such transfers. In addition, the GDPR provides that EU member states may make their own further laws and regulations limiting the processing of personal data, including genetic, biometric or health data. The GDPR provides for penalties for noncompliance of up to the greater of €20 million or four percent of worldwide annual revenues. The GDPR applies extraterritorially, and we may be subject to the GDPR because of our data processing activities that involve the personal data of individuals located in the EU, such as in connection with any EU clinical trials. Additionally, the UK has implemented legislation that substantially implements the GDPR (the "UK GDPR"), with substantial penalties for noncompliance.

63

Further, various states, such as California, Massachusetts, and Washington have implemented privacy laws and regulations that impose restrictive requirements regulating the use and disclosure of health information