Company: IXHL
Filing Date: 2025-09-29
Form Type: 10-K
Source: 0001213900-25-092837
Chunk: 104

Company: Incannex Healthcare Inc.
Filing Date: 2025-09-29
Form: 10-K
Item: Item 1
Chunk 104
---
 of personal data to countries outside the European Union and
permits data protection authorities to impose large penalties for violations of the GDPR, including potential fines of up to €20
million or 4% of annual global revenues, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer
associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from
violations of the GDPR. Compliance with the GDPR will be a rigorous and time-intensive process that may increase the cost of doing business
or require companies to change their business practices to ensure full compliance.

In July 2023, the European Commission adopted an
adequacy decision for a new mechanism for transferring data from the European Union to the United States - the EU-US Data Privacy Framework,
which provides individuals in the European Union with several new rights, including the right to obtain access to their data, or obtain
correction or deletion of incorrect or unlawfully handled data. The adequacy decision followed the signing of an executive order introducing
new binding safeguards to address the points raised by the Court of Justice of the European Union (“CJEU”) in its decision
on a case known as Schrems II, which invalidated the previous EU-US Privacy Shield. Notably, the new obligations were geared to
ensure that data can be accessed by U.S. intelligence agencies only to the extent necessary and proportionate and to establish an independent
and impartial redress mechanism to handle complaints from Europeans concerning the collection of their data for national security purposes.
The European Commission will continually review developments in the United States along with its adequacy decision. Adequacy decisions
can be adapted or even withdrawn in the event of developments affecting the level of protection in the applicable jurisdiction. Future
actions of European Union data protection authorities are difficult to predict. Some customers or other service providers may respond
to these evolving laws and regulations by asking us to make certain privacy or data-related contractual commitments that we are unable
or unwilling to make. This could lead to the loss of current or prospective customers or other business relationships.

Following the United Kingdom’s withdrawal
from the European Union, the GDPR has been implemented in the United Kingdom (as the “UK GDPR”). The UK GDPR sits alongside
the amended United Kingdom Data Protection Act 2018 which implements certain derogations in the EU GDPR into United Kingdom law. Under
the UK GDPR, companies not established in the United Kingdom but who process personal data in relation to the offering of goods