Company: TIPT
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001393726-25-000028
Chunk: 113

Company: TIPTREE INC.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 113
---
 insurance subsidiaries operate will enact the Insurance Data Security Model Law in whole or in part, or in a modified form. Such enactments, especially if inconsistent between states or with existing laws and regulations, could raise compliance costs or increase the risk of noncompliance, and noncompliance could subject our insurance subsidiaries to regulatory enforcement actions and penalties, as well as reputational harm. Any such events could potentially have an adverse impact on our insurance subsidiaries’ business, results of operations, financial condition and cash flows.

Our insurance and mortgage subsidiaries are subject to the privacy regulations of the Gramm-Leach-Bliley Act of 1999 (the “Gramm-Leach-Bliley Act”), along with its implementing regulations, which restricts certain collection, processing, storage, use and disclosure of personal information, requires notice to individuals of privacy practices, provides individuals with certain rights to prevent the use and disclosure of certain nonpublic or otherwise legally protected information and imposes requirements for the safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines. In addition, on March 1, 2017, new cybersecurity rules took effect for financial institutions, insurers and certain other companies, like our insurance and mortgage subsidiaries, supervised by the NY Department of Financial Services (the “NY DFS Cybersecurity Regulation”). The NY DFS Cybersecurity Regulation imposes significant regulatory burdens intended to protect the confidentiality, integrity and availability of information systems. Our insurance and mortgage subsidiaries also have contractual obligations to protect confidential and personally identifiable information we obtain from third parties. These obligations generally require them, in accordance with applicable laws, to protect such information to the same extent that they protect their own such information. 

Many states in which our insurance and mortgage subsidiaries operate have laws that protect the privacy and security of sensitive and personal information. Certain current or proposed state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts. For example, certain of our insurance and mortgage businesses are subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), which among other things, requires companies covered by the legislation to provide disclosures to California consumers and affords such consumers rights of access and deletion of personal information. Internationally, many jurisdictions have established their own data security and privacy legal framework with which our insurance subsidiaries operating in such