Company: ATRA
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0000950170-25-035507
Chunk: 145

Company: Atara Biotherapeutics, Inc.
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1A
Chunk 145
---
 as the UK GDPR (together, the UK GDPR and the EU GDPR, the GDPR). Under the UK GDPR, companies established in the UK and companies not established in the UK but who process personal information of individuals in the UK in relation to the offering of goods or services to those individuals, or to the monitoring of their behavior will be subject to the UK GDPR. As such, the GDPR applies to us to the extent we are established in an EU Member State or the UK, we are processing personal information in the context of an establishment in an EU Member State or the UK or we are processing personal information in relation to the offering of goods or services to individuals in the EEA or the UK or monitoring their behavior.

The GDPR imposes onerous and comprehensive privacy, data protection, and data security obligations onto controllers, including, as applicable: (i) contractual privacy, data protection, and data security commitments, including the requirement to implement appropriate technical and organizational measures to safeguard personal information processed; (ii) establishing means for individuals to exercise their data protection rights (e.g., the right to erasure of personal information); (iii) limitations on retention and the amount of personal information processed; (iv) additional requirements pertaining to sensitive information (such as health data); (v) data breach notification requirements to: (x) supervisory authorities without undue delay (and no later than 72 hours where feasible) after becoming aware of the breach, unless the breach is unlikely to result in a risk to the data subjects’ rights and freedoms; and/or (y) concerned individuals where the breach is likely to result in a high risk to their rights and freedoms; (vi) requirements to process personal information lawfully including specific requirements for obtaining valid consent from data subjects where consent is the lawful basis for processing; (vii) obligations to consider data protection as any new products or services are developed and designed; and (viii) accountability and transparency requirements, which require controllers to demonstrate and record compliance with the GDPR and to provide more detailed information to data subjects(such as clinical trial subjects and investigators) regarding processing. The GDPR also provides that EU Member States and the UK (as applicable) may introduce further laws and regulations limiting the processing of genetic, biometric, or health data, which could limit our ability to collect, use and share personal information subject to the GDPR, cause our compliance costs to increase, require us to change our practices, adversely impact our business, and harm our financial condition.

73

In addition, the EU GDPR also prohibits