Company: LIMN
Filing Date: 2025-06-24
Form Type: S-1
Source: 0001410578-25-001432
Chunk: 56

Company: Liminatus Pharma, Inc.
Filing Date: 2025-06-24
Form: S-1
Chunk 56
---
, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”). This legislation imposes requirements relating to having legal bases for processing personal information relating to identifiable individuals and transferring such information outside of the European Economic Area, including to the United States, providing details to those individuals regarding the processing of their personal information, keeping personal information secure, having data processing agreements with third parties who process personal information, responding to individuals’ requests to exercise their rights in respect of their personal information, reporting security breaches involving personal data to the competent national data protection authority and affected individuals, appointing data protection officers, conducting data protection impact assessments and record-keeping. This legislation imposes significant responsibilities and liabilities in relation to personal data that we process, and we may be required to put in place additional mechanisms ensuring compliance. In particular, with respect to cross-border transfers of personal data, judicial and regulatory developments in the European Union have created uncertainty. In a decision issued by the Court of Justice of the European Union (“CJEU”) on July 16, 2020, the CJEU invalidated one mechanism for cross-border personal data transfer, the EU-U.S. Privacy Shield, and imposed additional obligations on companies, including us, relying on standard contractual clauses (“SCCs”) issued by the European Commission for cross-border personal data transfers. The European Commission released new SCCs designed to address the CJEU concerns on June 4, 2021. We have undertaken certain efforts to conform transfers of personal data from the European Economic Area (“EEA”) to the United States to our understanding of current regulatory obligations and guidance of data protection authorities, but the CJEU’s decision, the revised SCCs, regulatory guidance and opinions, and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of the EEA, which may increase compliance costs, lead to increased regulatory scrutiny or liability, may require additional contractual negotiations, and may adversely impact our business, financial condition and operating results. Any actual or alleged failure to comply with the requirements of the GDPR or other laws, regulations, and directives of the member states of the European Union may result in substantial fines, other administrative penalties and civil claims being brought against us, which could have a material adverse effect on our business, financial condition and results of operations.

In addition, U.S. states are adopting new laws or amending existing laws and regulations, requiring attention to frequently changing regulatory requirements applicable to data related to individuals. For example, California has enacted the California