Company: BCS
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0000312069-25-000114
Chunk: 492

Company: BARCLAYS PLC
Filing Date: 2025-02-13
Form: 20-F
Chunk 492
---
ustainability report | Governance |     | Riskreview | Financialreview | Financialstatements |     | Barclays PLC 2024Annual Reporton Form 20-F | 316 |
| Supervision and regulation (continued) |                        |                                  |            |     |            |                 |                     |     |                                            |     |

Data protection Most jurisdictions where the Group operates have adopted or are considering comprehensive laws concerning data protection and privacy. Regulations regarding data protection are increasing in number, as well as levels of enforcement, as manifested in increased amounts of fines and the severity of other penalties. We expect that personal privacy and data protection will continue to receive attention and focus from regulators, as well as public scrutiny and attention. The EU’s General Data Protection Regulation (GDPR) and the UK’s General Data Protection Regulation (UK GDPR) provide a framework of rights and duties designed to safeguard personal data and apply to the activities conducted from an establishment in the EU or the UK, respectively. The extraterritorial effect of the GDPR and the UK GDPR means entities established outside the EU or the UK may fall respectively within the GDPR or the UK GDPR’s ambit when offering goods or services to EU/UK based customers or clients or conducting behavioural monitoring of individuals in the EU/UK. The Data (Use and Access) Bill was introduced to the UK Parliament in October 2024, which if enacted will bring some divergence between the EU GDPR and UK GDPR. The data regime in China is likely to continue to evolve, governing the collection, processing and cross-border transfers of China-based individuals' personal data and restricted data (e.g., macro/derived characteristics data which, if tampered with, divulged or destroyed, may endanger China's economic operation, social stability, national security - among other things - having regard to the volume and granularity of the data). In India, in preparation for the implementation of the Digital Personal Data Protection Act, which passed in 2023, the Government has yet to issue finalised implementation rules for a robust mechanism of privacy protection and rights. Except under certain exemptions, its scope would include the processing of personal data in India and would extend to the profiling of, and offering goods and services to, India-based individuals outside of India. As the global data protection regulatory landscape develops, non- compliance with any such requirements and rules could lead to regulatory fines and other penalties. In the US, Barclays Bank Delaware is subject to the US Gramm-Leach-Bliley Act (GLBA) and the California Consumer Privacy Act of 2018, as