Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 944

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 944
---
 and

| 897 |

| Contents |     | Cross-reference to Form 20-F |     | Consolidated director's report |     | Consolidated financial statements |     | Supplemental information |

the right not to be discriminated against for exercising their rights. Other states where we do business, or may in the future do business, or from which we otherwise collect, or may in the future otherwise collect, personal information of residents have enacted, or are considering enacting, comprehensive privacy, data protection and cybersecurity laws that share similarities with the CCPA. These state statutes, and other similar state or federal laws that may be enacted in the future, may require us to modify our data processing practices and policies, incur substantial compliance-related costs and expenses, and otherwise suffer adverse impacts on our business. In addition, laws in all 50 US states generally require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach, and we may be required to report events related to privacy, data protection or cybersecurity issues, events where customer information may be compromised, unauthorized access to our systems and other security breaches, to affected individuals or the relevant regulatory authorities. These laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly.

Additionally, our New York branch is supervised by the New York State Department of Financial Services (NYDFS). The NYDFS issued Cybersecurity Requirements for Financial Services Companies, which took effect in 2017 and was amended in November 2023, and which require banks, insurance companies and other financial services institutions regulated by the NYDFS to establish and maintain a cybersecurity program designed to protect consumers and ensure the safety and soundness of New York State’s financial services industry. The cybersecurity regulation includes specific requirements for these institutions’ cybersecurity compliance programs and imposes an obligation to conduct ongoing, comprehensive risk assessments. Further, on an annual basis, each institution is required to submit a certification of compliance with these requirements.

Privacy, data protection and cybersecurity laws, rules, regulations and standards continue to evolve and may result in ever-increasing public scrutiny and escalating levels of enforcement and sanctions. We may become subject to new laws, rules, regulations or standards concerning privacy, data protection or cybersecurity, which could require us to incur significant additional costs and expenses in order to comply. While we have taken steps designed to mitigate the impact of risks and uncertainties in connection with applicable privacy, data protection and cybersecurity laws, rules, regulations and standards by implementing supplementary measures designed in accordance therewith