Company: AHL
Filing Date: 2025-03-20
Form Type: F-1/A
Source: 0001628280-25-014149
Chunk: 372

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-20
Form: F-1/A
Chunk 372
---
 of the NYDFS Cybersecurity Regulation, which includes updated requirements related to: governance; controls to prevent unauthorized access to information systems, such as password controls and monitoring; risk and vulnerability assessment requirements; notification requirements; and cybersecurity training. We anticipate that the NYDFS will continue to examine the cybersecurity programs of financial institutions in the future and such examinations may result in additional expenditure of resources and regulatory scrutiny.

In 2017, the NAIC also adopted the Insurance Data Security Model Law (the “Cybersecurity Model Law”). The Cybersecurity Model Law requires insurers, insurance producers and other entities required to be licensed under state insurance laws to comply with certain requirements under state insurance laws, such as developing and maintaining a written information security program, overseeing the data security practices of third-party vendors, and providing notice of certain data breaches. As with all NAIC model laws, this Insurance Data Security Model Law must be adopted by a state before becoming law in such state. The Cybersecurity Model Law closely resembles the NYDFS Cybersecurity Regulation and as of February 1, 2025, a version of the Cybersecurity Model Law has been adopted by more than 25 U.S. states.

Several states have enacted broad comprehensive data privacy laws that require businesses in scope to disclose information about their privacy practices and give state residents rights to access, delete, and correct their personal information and to opt out of the use of their information for targeted advertising, profiling that results in the provision or denial of decisions including insurance services, and from having their personal information sold to third parties. Most of these laws broadly exempt entities covered by the GLBA or insurers more generally. However, in 2018, California enacted the California Consumer Privacy Act (“CCPA”), which came into effect on January 1, 2020, and broadly regulates the collection, processing and disclosure of the personal information of California residents, imposes limits on the “sale” of personal information and grants California residents certain rights to,

<div align='center'>243</div>

Table of C ontents

among other things, access and delete data about them in certain circumstances. CCPA also established a private right of action, with potentially significant statutory damages, whereby businesses that fail to implement reasonable security measures to protect against breaches of personal information could be liable to affected consumers. The CCPA was expanded substantially on January 1, 2023, when the California Privacy Rights Act of 2020 (“CPRA”) amendments to the CCPA became fully operative. The amended CCPA, among other things, gives California residents