Company: GIFLF
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001104659-25-034245
Chunk: 43

Company: Grifols SA
Filing Date: 2025-04-11
Form: 20-F
Item: Item 3
Chunk 43
---
 providers handle the personal information of our patients and beneficiaries, patient personal data, throughout the United States and other parts of the world. We or our business associates may experience data breaches in violation of the requirements of HIPAA, GDPR and or other similar laws, for example:

●   data breaches involving the impermissible use, access, or disclosure of patient identifying information or unsecured personal data;
---------------------------------------------------------------------------------------------------------------------------------------

●   a data breach where we or our business associates neglect to implement the required administrative, technical and physical safeguards of its electronic systems and devices, or
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

●   a data breach that results in impermissible use, access or disclosure of personal identifying information of our employees, beneficiaries, and/or plasma or blood donors.
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
When appropriate, we have filed complaints against the unknown attackers with the relevant authorities and we contacted the patients who were affected by the illegal data publication as well as other relevant regulatory authorities and stakeholders. While there has not been any material impact to our financial condition and results of operations as a result of these data breaches and attacks, future cyber-attacks against our IT systems may result in a loss of financial data or interruptions of our operations that could have a material adverse impact on our business, financial condition and results of operations in the future. The Ukraine War has increased the risk of cyber-attacks against our systems and data. 
As we increase the amount of sensitive personal information or financial data that we store and share digitally, our exposure to these privacy and data breaches and cyber-attack risks increases (particularly as medical or pharmaceutical records are a high-value target), including the risk of undetected attacks, damage, loss or unauthorized disclosure or access, and the cost of attempting to protect against these risks also increases. There are no assurances that our security technologies, processes and procedures that we or our outside service providers have implemented to protect sensitive personal information and proprietary or confidential information and to build security into the design of our products will be effective. 

27

Any failure to keep our information technology systems, financial data and our patients’ and customers’ sensitive information secure from attack, damage, loss or unauthorized disclosure or access, whether as a result of our action or inaction or that of our third-party business associates or vendors that utilize and store such personal information on our behalf, could materially adversely affect our reputation and ability to continue normal operations, expose us to mandatory public disclosure requirements, litigation and governmental enforcement proceedings, material fines, penalties and/or remediation costs, and compensatory, special, punitive and statutory damages,