Company: AHL
Filing Date: 2025-04-29
Form Type: F-1/A
Source: 0001628280-25-020463
Chunk: 361

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-04-29
Form: F-1/A
Chunk 361
---
 their behavior will be subject to the U.K. GDPR and will be required to appoint a data protection representative in the U.K., provided certain exceptions are not met. Otherwise, the requirements of the U.K. GDPR are currently virtually identical to those of the E.U. GDPR and as such, may lead to similar compliance and operational costs. For information on E.U. GDPR and U.K. GDPR, refer also to “Risk Factors—Risks Related to Our Business—Other Operational Risks—Compliance with ever evolving national, federal, state, and international laws relating to the handling of information collected from or about individuals involves significant expenditure and resources, and any failure by us or our vendors to comply may result in significant liability, negative publicity and/or an erosion of trust, which could materially adversely affect our business, results of operations and financial condition.”

<div align='center'>241</div>

In addition, Brexit has implications for transfers of personal data between the U.K. and the EEA and vice versa. Transfers of personal data from the U.K. to the EEA and vice versa are unrestricted and do not require additional safeguards since the EEA has formally declared the U.K.’s data protection regime as “adequate” and similarly the U.K. has formally approved the adequacy of the E.U. As a result, transfers of personal data from the EEA to the U.K., and vice versa, remain unrestricted and do not require any additional safeguards. The duration of the current adequacy decision will expire on June 27, 2025, at which point the European Commission can decide whether to extend the adequacy decision for a further period up to a maximum of another four years.

E.U. / U.K. Cybersecurity and Privacy Laws and Regulations

The E.U. GDPR and U.K. GDPR (together referred to as the “GDPR”) impose comprehensive data privacy compliance obligations in relation to our collection, processing, sharing, disclosure, transfer and other use of personal data including a principal of accountability and the obligation to demonstrate compliance through policies, procedures, training and audits.

In addition, some of the personal data we process in respect to individual customers, policy holders or beneficiaries is special category or sensitive personal data under the GDPR, and subject to additional compliance obligations and to local law derogations. We may be subject to diverging requirements under E.U. member state laws and U.K. law, such as whether consent can be used as the legal basis for processing. As these laws develop, we may need