Company: ARWR
Filing Date: 2025-11-25
Form Type: 10-K
Source: 0000879407-25-000029
Chunk: 123

Company: ARROWHEAD PHARMACEUTICALS, INC.
Filing Date: 2025-11-25
Form: 10-K
Item: Item 1A
Chunk 123
---
 in particular the conduct of transfer risk/impact assessments to verify if anything in the law and/or practices of the third country may impinge on the effectiveness of the safeguards in the context of the transfer at stake and, if so, to identify and adopt supplementary measures. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions are subject to potential scrutiny from regulators, individuals and associations. In the EEA, beyond the GDPR framework, companies must also comply with national data protection laws, which supplement, interpret, and in some cases go beyond the GDPR or other EEA-level requirements, including with respect to health-related data. Data protection authorities from the different member states may also implement certain variations, enforce data protection laws differently, and introduce additional national regulations and guidelines, which adds to the complexity of processing personal data in the EEA. Guidance developed at both EEA level and at the national level in each member state concerning implementation and compliance practices is often updated or otherwise revised. Violations of national laws can trigger administrative investigations, corrective orders, temporary or definitive bans on processing, and, in some jurisdictions, criminal penalties.

Additionally, our use of artificial intelligence may be subject to laws and evolving regulations regarding the use of artificial intelligence, including as they relate to controlling for data bias and antidiscrimination.

Preparing for and complying with these obligations require us to devote resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. 

If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government regulatory enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims); additional reporting requirements and/or oversight; bans on processing personal data; and orders to destroy or not use personal data. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; inability to process personal data or to operate in certain 

55

jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

Economic and Industry Risks

Unfavorable global economic conditions, whether brought about by material global crises, health epidemics, military conflicts