Company: NCNA
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0000950170-25-042709
Chunk: 32

Company: NuCana plc
Filing Date: 2025-03-20
Form: 20-F
Item: Item 3
Chunk 32
---

shorten any periods during which we may have the exclusive right to commercialize our product candidates or allow our competitors to bring products to market before we do and impair our ability to successfully commercialize our product candidates and may harm our business and results of operations.
 We face regulation and potential liability related to the privacy of personal data, including health information we obtain from clinical trials sponsored by us or our collaborators.
 The regulatory environment surrounding information security and privacy is increasingly demanding, and these laws and regulations are increasing in complexity and number, and may change frequently and sometimes conflict. We are subject to numerous regulations governing the protection of personal and confidential information of our clinical trial subjects, clinical investigators, and employees, including in relation to medical records, credit card data and financial information, which encompass state privacy and confidentiality laws (including state laws requiring disclosure of breaches), federal and state consumer protection and employment laws, the Health Insurance Portability and Accountability Act, or HIPAA, and European and other foreign data protection laws. For example, the European Union General Data Protection Regulation, or GDPR, is applicable in all E.U. member states and member states of the European Economic Area, or E.E.A. In the United Kingdom the data protection obligations of the GDPR continue to apply to U.K.-related processing of personal data in substantially unvaried form and fashion (retained in U.K. law as the “U.K. GDPR”).
 We are subject to the GDPR and/or U.K. GDPR when conducting clinical trials involving U.K.- or E.E.A.-based data subjects (whether the trials are conducted directly by us or through a clinical vendor or collaborator) or offering approved products (or any other products or services) to U.K.- or E.E.A.-based data subjects (regardless of whether involving a U.K. or E.E.A. based subsidiary or operation), when monitoring of their behavior of data subjects in the United Kingdom or E.E.A. and/or when acting through a U.K.- or E.E.A.-based subsidiary, operation or other establishment.
 The GDPR (and U.K. GDPR) sets out a number of requirements that must be complied with when handling personal data (i.e., data relating to an identified or identifiable living individual) in these circumstances, including: having an appropriate lawful basis for processing, and a relevant condition if processing ‘special category’ personal data (which includes personal data related to health, biometric data used for unique identification purposes and genetic information); the obligation to appoint data protection officers in certain circumstances; accountability and