Company: AXS-PE
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001214816-25-000056
Chunk: 249

Company: AXIS CAPITAL HOLDINGS LTD
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 249
---
 requirements which in turn could materially adversely affect our ability to conduct our business. 

43

Regulatory Risk

Regulatory risk represents the risk arising from our failure to comply with legal, statutory or regulatory obligations. 

Compliance with data protection, privacy and cybersecurity laws and regulations governing the processing of personal information is a legal requirement, and non-compliance may impede our services or result in increased costs. Failure to comply could result in material fines and/or penalties imposed by data protection and/or financial services regulators. In addition, any data breach may have an adverse effect on our reputation, results of operations or financial condition, or have other adverse consequences.

Our business relies on the processing of data, including personal information, in many jurisdictions and the movement of such data across national borders. The collection, storage, handling, disclosure, use, transfer, security and other processing of personal information that occurs in connection with our business is subject to federal, state, local and foreign data protection and privacy laws, regulations, rules, industry standards and other obligations. These legal requirements are not uniform and continue to evolve, and regulatory scrutiny in this area is increasing around the world. In many cases, these laws and regulations apply not only to third-party transactions, but also to transfers of information within the Group. Data protection, privacy and cybersecurity laws may be interpreted and applied differently from country to country and may create inconsistent or conflicting requirements.

In Europe, the U.K., and Switzerland, there are data protection laws that have extra-territorial effect. These data protection laws require compliance by all companies that process data of EU, U.K., and Swiss citizens, regardless of the company’s location, and also impose obligations on companies processing data of non-E. citizens. The data protection laws also impose requirements regarding the processing of personal data and confers rights on data subjects, including rights of access to their personal data, deletion of their personal data, the "right to be forgotten" and the right to "portability" of personal data. 

We also need to comply with data protection laws in the U.S and Canada. In the U.S., there continue to be many changes in the data protection and privacy landscape. As states continue to focus on data protection, our compliance burden may increase.

Further, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, regulations, rules and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or