Company: OCEA
Filing Date: 2025-04-08
Form Type: 10-K
Source: 0001641172-25-003155
Chunk: 2261

Company: Ocean Biomedical, Inc.
Filing Date: 2025-04-08
Form: 10-K
Item: Item 1A
Chunk 2261
---
 and time
consuming and may ultimately prevent us from transferring personal data outside the EEA, which would cause significant business disruption.
Until the legal uncertainties regarding how to legally continue transfers pursuant to the SCCs and other mechanisms are settled, we will
continue to face uncertainty as to whether our efforts to comply with our obligations under the GDPR will be sufficient. This and other
future developments regarding the flow of data across borders could increase the complexity of transferring personal data across borders
in some markets and may lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity, which could have
an adverse effect on our reputation and business.

In
addition, following the UK’s exit from the European Union, or Brexit, on January 31, 2020 and the transition period through December
31, 2020 during which the GDPR continued to apply in the UK, on January 1, 2021, the GDPR was brought into UK law as the ‘UK GDPR.’
On June 28, 2021, the EU Commission adopted two adequacy decisions for the UK, which enabled the free flow of data from the EU to the
UK, where the level of data protection is essentially the same as that guaranteed under EU law. Nonetheless, there may be further developments
about the regulation of particular issues such as UK-EU data transfers that may require us to take steps to ensure the lawfulness of
our data transfers.

The
GDPR increases substantially the penalties to which we could be subject in the event of any non-compliance, including fines of up to
10,000,000 Euros or up to 2% of our total worldwide annual turnover for certain comparatively minor offenses, or up to 20,000,000 Euros
or up to 4% of our total worldwide annual turnover, whichever is greater, for more serious offenses. The GDPR also confers a private
right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies,
and obtain compensation for damages resulting from violations of the GDPR. The GDPR also introduces the right for non-profit organizations
to bring claims on behalf of data subjects.

Further,
national laws of member states of the EU are in the process of being adapted to the requirements under the GDPR, thereby implementing
national laws which may partially deviate from the GDPR and impose different obligations from country to country, so that we do not expect
to operate in a uniform legal landscape in the EEA. Also, as it relates to processing and