Company: GLPG
Filing Date: 2025-03-27
Form Type: 20-F
Source: 0001558370-25-003806
Chunk: 68

Company: GALAPAGOS NV
Filing Date: 2025-03-27
Form: 20-F
Item: Item 3
Chunk 68
---
 damages resulting from violations of the GDPR. The GDPR increases our responsibility and liability in relation to personal data that we process where such processing is subject to the GDPR, and we may be required to put in place and maintain additional mechanisms to ensure compliance with the GDPR. Compliance with the GDPR is a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm in connection with our personal data processing activities. A similar legislative framework, including similar obligations and penalties, applies in Switzerland, where similar efforts are needed.
​
If we are investigated by a data protection authority, we may face fines and other penalties. Any such investigation or charges by data protection authorities could have a negative effect on our existing business and our ability to attract and retain new clients or pharmaceutical partners. We may also experience hesitancy, reluctance, or refusal by European or multi-national clients or pharmaceutical partners to continue to use our products due to the potential risk exposure as a result of the current (and, in particular, future) data protection obligations imposed on 

​
44

them by certain data protection authorities in interpretation of current law, including the GDPR. Such clients or pharmaceutical partners may also view any alternative approaches to compliance as being too costly, too burdensome, too legally uncertain, or otherwise objectionable and therefore decide not to do business with us. Any of the foregoing could materially harm our business, prospects, financial condition and results of operations.
​
Despite our efforts to ensure compliance with the GDPR, we may not be successful either due to internal or external factors such as resource allocation limitations. Non-compliance could result in proceedings against us by governmental entities, customers, data subjects, consumer associations or others, as well as in penalties issued by data protection authorities as is also stated above.
​
We may also fail to comply with other privacy and data protection laws and regulations in other jurisdictions where we are active and/ or operating, including but not limited to the United States.
​
Although we have invested time and resources in the protection of its personal data and information technology and monitors its systems on an ongoing basis, some immaterial incidents have occurred in respect of which we have taken appropriate measures. To date, no material risk has been identified, and our business and operations have not been materially impacted by such incidents.
​
Business interruptions could delay us in the process of developing our product candidates.
​
Loss of