Company: NCNA
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0000950170-25-042709
Chunk: 36

Company: NuCana plc
Filing Date: 2025-03-20
Form: 20-F
Item: Item 3
Chunk 36
---
 suspected violations of the GDPR, including extensive audit and inspection rights, and powers to order temporary or permanent bans on all or some processing of personal data carried out by non-compliant actors.
 In addition to the foregoing, a breach of privacy laws or data security laws, particularly those resulting in a significant cybersecurity incident or breach involving the misappropriation, corruption, modification, loss or other unauthorized use or disclosure of sensitive or confidential patient or consumer information, could have a material adverse effect on our business, reputation and financial condition. In addition, widely publicized security breaches are increasingly being followed in the European Union by attempts to bring large ‘class action’ style claims; this trend is likely to continue in light of recent decisions by the European Court of Justice confirming data subjects’ right to compensation even for minor non-material damage. Although such ‘class action’ style claims have yet to succeed in any significant compensation orders, defending these claims is costly and could still result in substantial liability for compensation and legal fees. As a data controller, we are accountable for any third-party service providers we engage to process personal data on our behalf, including our CROs. We attempt to mitigate the associated risks by performing security assessments and due diligence of our vendors and requiring all such third-party providers with data access to sign agreements, and obligating them to only process data according to our instructions and to take sufficient security measures to protect such data. There is no assurance that these contractual measures and our own privacy and security-related safeguards will protect us from the risks associated with the

third-party processing, storage and transmission of such information. Any violation of data or security laws by our third-party processors could have a material adverse effect on our business and result in fines, penalties and/or other enforcement actions outlined above.
 In addition, various U.S. states have enacted privacy and security laws and regulations, and such laws and regulations vary from state to state, constantly evolve, and remain subject to significant change. In some cases, such laws and regulations can impose more restrictive requirements than HIPAA and other U.S. federal laws, thus complicating compliance efforts. Several U.S. federal and state laws establish additional requirements for protecting the privacy and security of health information that is not protected by HIPAA. For instance, Washington State recently passed the “My Health My Data” Act, which regulates “consumer health data,” which is defined as “personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health.” The “My Health