42 Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union’s General Data Protection Regulation, or EU GDPR, and the United Kingdom’s GDPR, or UK GDPR (collectively, GDPR), impose strict requirements for processing personal data. Violators of these laws face significant penalties. For example, government regulators may impose temporary or definitive bans on data processing and other corrective actions, as well as fines of up to 20 million Euros (under the EU GDPR) or 17.5 million pounds sterling (under the UK GDPR), or 4% of annual global revenue, whichever is greater, under either law. Further, the EU and UK GDPR also provide for private litigation related to the processing of personal data that can be brought by classes of data subjects or consumer protection organizations authorized at law to represent the data subjects’ interests. In addition, we may be unable to transfer personal data from Europe and other jurisdictions to the United States or other countries due to data localization requirements or limitations on cross-border data transfers. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms (such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement/Addendum, and the EU-U.S. Data Privacy Framework and the UK extension), that may be used to lawfully transfer personal data to the United States or other countries, these mechanisms are subject to legal challenges and there is no assurance that we can satisfy or rely on these measures. An inability or material limitation on our ability to transfer personal data to the United States or other countries could materially impact our business operations. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Europe and other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations by limiting our ability to conduct clinical trial activities in Europe and elsewhere; limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense. Additionally, entities that transfer personal data across borders are subject to increased regulator, individual and activist group scrutiny. Some European regulators have ordered certain companies to suspend or permanently cease certain data transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer requirements. In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and, we are, and may become in the future, subject to such obligations. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We also publish statements regarding data privacy and security. Regulators in the U.S. are increasingly scrutinizing these statements, and if these statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading or misrepresentative of our practices, we may be subject to investigation, enforcement actions and other adverse consequences. Obligations related to data privacy and security (and individuals’ data privacy and security expectations) are quickly changing, becoming increasingly stringent and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business model. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations which could negatively impact our business. If we or any third party with whom we work fail or are perceived to have failed to address or comply with applicable obligations relating to data privacy and security, we could face significant consequences, including but not limited to: regulatory fines and bans on processing personal data; investigations and enforcement actions, penalties and other liabilities, litigation (including class action claims and mass arbitration demands); additional reporting requirements and/or oversight; orders to destroy or not use personal data; interruptions to our development process; and damage to our reputation, any of which could materially affect our business, financial condition, results of operations and growth prospects.