Company: NCNA
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0000950170-25-042709
Chunk: 35

Company: NuCana plc
Filing Date: 2025-03-20
Form: 20-F
Item: Item 3
Chunk 35
---
 this regard. However, any changes relating to the U.K. and E.U. position regarding aspects of data protection law may lead to additional compliance costs and could increase our overall risk. The Bill also significantly increases the maximum fines for the U.K.’s direct marketing and ‘cookie compliance’ rules, from the current £500,000 to GDPR levels (see below).
 Alongside the GDPR, the European Union has recently passed a number of new laws affecting data and security, including the Data Governance Act, the Network and Information Security (NIS) 2 Directive and the European Health Data Space, or EHDS, Regulation. The EHDS Regulation is likely to, for example, require us to make health data available to other organizations in this sector (in an anonymized form) and to the patients themselves. The EHDS was adopted by the Council of the European Union in January 2025, and will enter into force after being formally signed by the Council and European Parliament. We are likely to have to devote substantial resources to understanding and preparing for it.
 These laws and regulations are increasing in complexity and number, and new regulatory guidance and case law means the regulatory landscape changes frequently. Complying with these numerous, complex and often changing regulations is expensive and difficult. Failure by us, any partners, our service providers, or our employees or contractors to comply with the GDPR could result in regulatory investigations, enforcement notices and/or fines of up to the higher of €20 million or up to 4% of our total worldwide annual turnover. Further, following the withdrawal of the United Kingdom from the European Union, we now have to comply with the GDPR and U.K. GDPR separately, each regime separately having the ability to fine up to the higher of €20 million / £17.5 million or 4% of global turnover. In addition, the value of fines issued by supervisory authorities has increased substantially in recent years: numerous multi-million € / £ fines have been issued by supervisory authorities across the E.E.A. and by the U.K. Information Commissioner’s Office, and the first €1.2 billion fine was issued against Meta by the Irish supervisory authority in May 2023. Guidance from the European Data Protection Board has indicated that turnover will be taken into account when defining the starting amount of fines, resulting in higher fines for larger organizations. Therefore, we expect the amount of fines to continue to rise. In addition to administrative fines, a wide variety of other potential enforcement powers are available to competent authorities in respect of potential and