Company: AHL
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001267395-25-000019
Chunk: 128

Company: ASPEN INSURANCE HOLDINGS LTD
Filing Date: 2025-03-19
Form: 20-F
Item: Item 4
Chunk 128
---
 17.5 million or 4% of our global annual turnover. In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease/change our data processing activities, enforcement notices, assessment notices (for a compulsory audit) and/or civil claims (including class actions).

Table of Contents

The GDPR regulates cross-border transfers of personal data out of the EEA and the U. K. Case law from the Court of Justice of the European Union (“ CJEU”) states that reliance on the standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances, and that transfers must be assessed on a case-by-case basis and supported by a transfer impact assessment followed by the implementation of additional protection measures as appropriate. On October 7, 2022, President Biden signed an Executive Order on ‘ Enhancing Safeguards for United States Intelligence Activities’ which introduced new redress mechanisms and binding safeguards to address the concerns raised by the CJEU in relation to data transfers from the EEA to the United States and which formed the basis of the new E. U.-U. S. Data Privacy Framework (“ DPF”), as released on December 13, 2022. The European Commission adopted its adequacy decision in relation to the DPF on July 10, 2023, rendering the DPF effective as an E. U. GDPR transfer mechanism to U. S. entities self-certified under the DPF. On October 12, 2023, the U. K. Extension to the DPF came into effect (as approved by the U. K. Government) as a U. K. GDPR data transfer mechanism to U. S. entities self-certified under the U. K. Extension to the DPF. We currently rely on the E. U. standard contractual clauses and the U. K. Addendum to the EU standard contractual clauses and the U. K. International Data Transfer Agreement, as relevant, to transfer personal data outside the EEA and the U. K. with respect to both intragroup and third party transfers. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the DPF adequacy decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by E. U. regulators. As the regulatory guidance and enforcement landscape in relation to