Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 1013

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 1013
---
 Protection and the safeguarding of digital rights which repealed the Spanish Organic Law 15/1999, of 13 December, on Data Protection. The GDPR, together with national legislation, regulations and guidelines of the EU member states governing the processing of personal data, imposes strict obligations and restrictions on the ability to collect, use, retain, protect, disclose, transfer and otherwise process personal data. In particular, the GDPR includes obligations and restrictions concerning the security and confidentiality of personal data and the rights of individuals to whom the personal data relates, such as obtaining consent from such individuals, the transfer of personal data out of the EEA and security breach notifications. Additionally, following the UK’s withdrawal from the EU, Banco Santander is also subject to the UK GDPR, a version of the GDPR as implemented into UK law. While a number of basic existing principles have remained the same, the UK GDPR will not automatically incorporate changes made to the GDPR going forward (which would need to be specifically incorporated by the UK government). Moreover, the UK government has publicly announced plans to reform the UK GDPR in ways that, if formalized, are likely to deviate from the GDPR, all of which creates a risk of divergent parallel regimes and related uncertainty, along with the potential for increased compliance costs and risks for affected businesses. The GDPR and UK GDPR authorize significant fines and penalties for non-compliance of up to the higher of 4% of annual worldwide turnover or EUR 20 million (or GBP 17.5 million under the UK GDPR) and, for other specified infringements, fines and penalties of up to the higher of 2% of annual worldwide turnover of EUR 10 million (or GBP 8.7 million under the UK GDPR). European data protection authorities have already imposed fines for GDPR violations up to, in some cases, hundreds of millions of euros.

Recent legal developments in the EEA, including recent rulings from the CJEU and from various EU member state data protection authorities, have created complexity and uncertainty regarding transfers of personal data from the EEA to the US and other so-called third countries outside the EEA. While we have taken steps

to mitigate the impact on us, such as implementing SCCs, the efficacy and longevity of these mechanisms remain uncertain. Although the UK currently has an adequacy decision from the European Commission, such that SCCs are not required for the transfer of personal data from the EEA to the UK, that decision will sunset in June 2025 unless extended and it may be revoked in the future by the European