Company: ASAN
Filing Date: 2025-09-03
Form Type: 10-Q
Source: 0001477720-25-000200
Chunk: 179

Company: Asana, Inc.
Filing Date: 2025-09-03
Form: 10-Q
Item: Part I, Item 4
Chunk 179
---
 negatively affect our operations.

In addition to the European Union, a growing number of other global jurisdictions, such as Brazil, Japan, India and Canada, are considering or have passed legislation implementing privacy, data protection, and security 

63

requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our platform, particularly as we expand our operations internationally. Some of these laws, such as the General Data Protection Law in Brazil, the Act on the Protection of Personal Information in Japan, or India’s Information Technology Act impose similar obligations as those under the EU GDPR.

Domestic privacy, data protection, security, and consumer protection legislation is also becoming increasingly common in the United States. For example, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal information such as the right to access, correct, or delete certain personal information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal information, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the CCPA requires companies that process information of consumers, business representatives, and employees who are California residents to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain individual privacy rights. The CCPA provides for fines for intentional violations and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in other states and at the federal and local levels, and we expect more states to pass similar laws in the future. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging, and increase legal risk and compliance costs for us and the third parties with whom we work.

Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, and Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sharing of data, employment of certain individuals, and investor