Company: GGR
Filing Date: 2025-03-31
Form Type: 20-F
Source: 0001886190-25-000017
Chunk: 158

Company: Gogoro Inc.
Filing Date: 2025-03-31
Form: 20-F
Item: Item 16
Chunk 158
---
CTIONS THAT PREVENT INSPECTION
Not applicable.
ITEM 16.K. CYBERSECURITY
Risk management and strategy
Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through third-party assessments, internal IT Audits, IT security, governance, risk and compliance reviews. We have in place certain security infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program generally follows processes outlined in frameworks such as the ISO 27001 international standard for Information Security and we evaluate and evolve our security measures as appropriate. As part of the above processes, we regularly engage ISO auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. Since May 2022, our Information Security Management System has been certified for the succeeding three years to conform to ISO/IEC 27001:2013 requirements. Furthermore, we completed our transition to ISO/IEC 27001 in March 2025.
We also have a vendor risk assessment process consisting of distributing and reviewing supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors. We routinely assess our high-risk suppliers’ conformance to industry standards (e.g., ISO 27001 and ISO 27701), and we evaluate them for additional information, product, and physical security requirements.
As we generate and process a large amount of data through our platform and rely on our IT systems for our business operations, we face risks associated with cybersecurity threats. For more details, see “Item 3. Key Information — D. Risk Factors — Risks Related to Our Business — Any legal proceedings or claims against us could be costly and time-consuming to defend and could harm reputation regardless of the outcome”; “— Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruption in service, which could harm our business”; “— Interruptions, delays in service or inability to increase capacity, including internationally, at third-party data center facilities could impair the use or