38 In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights include, in relation to their personal data, the right to access, correct, delete and opt-out of certain data processing activities (such as targeted advertising, profiling and automated decision-making). The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. Certain of these state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act, or the CCPA, applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses subject to the law to provide specific disclosures in privacy notices and respond to requests of such individuals to exercise certain privacy rights. The CCPA provides for civil penalties and a private right of action for certain data breaches (which could lead to the recovery of significant statutory damages). Although these laws may exempt some data processed in the context of clinical trials, these laws increase compliance efforts, legal risks and compliance costs for us and the third parties with whom we work. Similar laws are being considered in other states as well as at the federal and local levels. We expect more legislatures to pass additional privacy or security laws in the future. Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the EU GDPR and the United Kingdom’s GDPR, or UK GDPR (collectively, GDPR), impose strict requirements for processing personal data. Violators of these laws face potential significant penalties. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros (under the EU GDPR) or 17.5 million pounds sterling (under the UK GDPR), or 4% of annual global revenue, whichever is greater. Further, the EU and UK GDPR also provide for private litigation related to the processing of personal data that can be brought by classes of data subjects or consumer protection organizations authorized at law to represent the data subjects’ interests. Our personnel and others with whom we work use generative artificial intelligence, or AI and/or automated decision- making technologies to perform their work, and the disclosure and use of personal data in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws and regulations regulating AI and/or automated decision-making technologies. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use AI and/or automated decision- making technologies, it could make our business less efficient and result in competitive disadvantages. In addition, we may be unable to transfer personal data from Europe and other jurisdictions to the United States or other countries due to, for example, data localization requirements or limitations on cross-border data transfers. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the EEA and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms (such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement/Addendum, and the EU-U.S. Data Privacy Framework and the UK extension), that may be used to lawfully transfer personal data to the United States or other countries, these mechanisms are subject to legal challenges and there is no assurance that we can satisfy or rely on these measures. An inability or material limitation on our ability to transfer personal data to the United States or other countries could materially impact our business operations. If there were no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States or other jurisdictions, or if the requirements for a legally-compliant transfer are too onerous, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Europe and other foreign jurisdictions. The inability to transfer personal data to the United States or other jurisdictions could significantly and negatively impact our business operations by limiting our ability to conduct clinical trial activities in Europe and elsewhere; limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense. Additionally, entities that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased regulator, individual litigant, and activist group scrutiny. Some European regulators have ordered certain companies to suspend or permanently cease certain data transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer requirements. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered persons (i.e., individuals and entities who are designated as such by the U.S. Attorney General or considered “foreign persons” and are majority owned by, organized under the laws of, a primary resident in, or a contractor of, a covered person or country of concern, as applicable) that impacts certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular