Company: CLX
Filing Date: 2025-08-08
Form Type: 10-K
Source: 0000021076-25-000039
Chunk: 33

Company: CLOROX CO /DE/
Filing Date: 2025-08-08
Form: 10-K
Item: Item 1A
Chunk 33
---
 as the public. The Company has in place disaster recovery and business continuity plans to address Company and third-party incidents, but if these plans or those of its third-party providers are not sufficient or comprehensive, or do not effectively resolve such breaches or breakdowns on a timely basis or at all, the Company may experience interruptions in its ability to manage or conduct business, as well as reputational harm, governmental fines, penalties, regulatory proceedings, litigation and remediation expenses, adverse impacts on employee morale, loss of customers or consumers, as well as heightened regulatory and legal scrutiny. The need to coordinate with various third-party service providers, including with respect to timely notification and access to personnel and information concerning an incident, may complicate the Company’s efforts to address issues that arise. As a result, the Company is subject to the risk that the activities associated with its third-party service providers can adversely affect its business, financial condition and results of operations, even if the attack or breach does not directly impact its systems or information.

Cyber-threats and techniques are becoming more sophisticated and are constantly evolving and are being made by groups and individuals with a wide range of expertise and motives, and this increases the difficulty of detecting and successfully defending against them. Continued geopolitical instability has also heightened the risk of cyberattacks. The Company has incurred, and will continue to incur, expenses to comply with privacy and data protection standards and protocols imposed by law, regulation, 

13

industry standards and contractual obligations. Increased regulation of data collection, use, and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, including reporting requirements, enactment of new laws and regulations, increased enforcement activity, and changes in interpretation of laws, could increase the Company's cost of compliance and operation, limit its ability to grow its business or otherwise harm its business.

In addition, data breaches or theft of personal information collected by the Company and its third-party service providers as well as data breaches or theft of Company information and assets have occurred in the past and may occur in the future. The Company is subject to the laws and regulations of various countries where it operates or does business related to solicitation, collection, processing, transferring, storing or use of consumer, customer, business partner or employee information or related data. These laws and regulations change frequently, and new legislation continues to be introduced and may include different standards and requirements, be interpreted and applied differently from jurisdiction to jurisdiction and create inconsistent or conflicting requirements. The changes introduced by data privacy and protection regulations increase the complexity of regulations enacted