Company: DRTSW
Filing Date: 2025-03-12
Form Type: 20-F
Source: 0001213900-25-023187
Chunk: 44

Company: Alpha Tau Medical Ltd.
Filing Date: 2025-03-12
Form: 20-F
Item: Item 3
Chunk 44
---
 and are continuing to be proposed
at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such
laws could have potentially conflicting requirements that would make compliance challenging. In the event that we are subject to or affected
by Israeli data protection laws, HIPAA, the CCPA or other domestic or foreign privacy and data protection laws, any liability from failure
to comply with the requirements of these laws could adversely affect our financial condition.

Our operations abroad
may also be subject to increased scrutiny or attention from data protection authorities. For example, in Europe, the General Data Protection
Regulation, or GDPR went into effect in May 2018 and imposes strict requirements for processing the personal data of individuals within
the European Economic Area, or EEA, or in the context of our activities within the EEA. Companies that must comply with the GDPR face
increased compliance obligations and risk, robust regulatory enforcement of data protection requirements and potential fines for noncompliance
of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. In addition to fines,
a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease/ change our data processing activities,
enforcement notices, assessment notices (for a compulsory audit) and/ or civil claims (including class actions). Among other requirements,
the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection
to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA, and
the United States remains uncertain. Case law from the Court of Justice of the European Union, or the CJEU, states that reliance on the
standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism
- alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On July 10,
2023, the European Commission adopted its Adequacy Decision in relation to the new EU-US Data Privacy Framework, or the DPF, rendering
the DPF effective as a GDPR transfer mechanism to U. S. entities self-certified under the DPF. We expect the existing legal complexity
and uncertainty regarding international personal data transfers to continue. In particular, we expect the DPF Adequacy Decision to be
challenged and international transfers to the United States and