Company: IXHL
Filing Date: 2025-09-29
Form Type: 10-K
Source: 0001213900-25-092837
Chunk: 310

Company: Incannex Healthcare Inc.
Filing Date: 2025-09-29
Form: 10-K
Item: Item 1A
Chunk 310
---
 in the United Kingdom (as the UK GDPR). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements
certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in
relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR -
the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance
and operational costs with potential fines of up to £17.5 million or 4% of global turnover.

Transfers of personal data to certain countries
outside of the EU and the UK are also highly regulated under the GDPR and UK GDPR. For example, the GDPR only permits exports of personal
data outside of the EU to “non-adequate” countries where there is a suitable data transfer mechanism in place to safeguard
personal data (e.g., the EU Commission approved Standard Contractual Clauses or certification under the newly-adopted Data Privacy Framework).
On July 16, 2020, the CJEU, issued a landmark opinion in the case Maximilian Schrems vs. Facebook (Case C-311/18) (“Schrems II”).
This decision calls into question certain data transfer mechanisms as between the EU member states and the U.S. The CJEU is the highest
court in Europe and the Schrems II decision heightened the burden to assess U.S. national security laws on their business, and future
actions of EU data protection authorities are difficult to predict at this time. While the Data Privacy Framework was meant to address
the concerns raised by the CJEU in Schrems II, it will likely be subject to future legal challenges. Consequently, there is some risk
of any data transfers from the EU being halted. If we have to rely on third parties to carry out services for us, including processing
personal data on our behalf, we are required under GDPR to enter into contractual arrangements to flow down or help ensure that these
third parties only process such data according to our instructions and have sufficient security measures in place. Any security breach
or non-compliance with our contractual terms or breach of applicable law by such third parties could result in enforcement actions, litigation,
fines and penalties or adverse publicity and could cause customers to lose trust in us, which would have an adverse impact on our reputation
and business. Any contractual arrangements requiring the processing