Company: ASAN
Filing Date: 2025-12-02
Form Type: 10-Q
Source: 0001477720-25-000237
Chunk: 324

Company: Asana, Inc.
Filing Date: 2025-12-02
Form: 10-Q
Item: Part I, Item 8
Chunk 324
---
 some uncertainty regarding the future of these cross-border data transfers. If we cannot implement a valid compliance mechanism for cross-border personal information transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal information from the EEA, UK, or elsewhere. Inability to import personal information to the United States may significantly and negatively impact our business operations, including limiting our ability to collaborate with service providers, contractors, and other companies subject to European and other privacy, data protection, and security laws; or requiring us to increase our data processing capabilities in Europe or elsewhere at significant expense. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Furthermore, rules regarding the use of online cookies and similar online trackers in the European Union are becoming more stringent in terms of the advance consent companies must obtain from data subjects before such trackers can be placed on browsers. Other regions of the world have likewise adopted privacy regulations that may result in increased restrictions on cookie collection and use, and fines for noncompliance. Partially as a result of these developments, individuals are becoming increasingly resistant to the collection, use, and sharing of personal information to deliver targeted advertising or analytics. Individuals are now more aware of options related to consent, “do not track” mechanisms (such as browser signals from the Global Privacy Control), and “ad-blocking” 

64

software to prevent the collection of their personal information for targeted advertising and analytics purposes. These developments may also impact our analytics and advertising activities and our ability to analyze how users interact with our services. We may be required to change the way we market our products, and any of these developments or changes could materially impair our ability to reach new or existing customers or otherwise negatively affect our operations.

In addition to the European Union, a growing number of other global jurisdictions, such as Brazil, Japan, India and Canada, are considering or have passed legislation implementing privacy, data protection, and security requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our platform, particularly as we expand our operations internationally. Some of these laws, such as the General Data Protection Law in Brazil, the Act on the Protection of Personal Information in Japan, or India’s Information Technology Act impose similar obligations as those under the EU GDPR.

Domestic privacy, data protection, security, and consumer protection legislation is also becoming increasingly common in the