Company: ASAN
Filing Date: 2025-12-02
Form Type: 10-Q
Source: 0001477720-25-000237
Chunk: 323

Company: Asana, Inc.
Filing Date: 2025-12-02
Form: 10-Q
Item: Part I, Item 8
Chunk 323
---
 to our business model or operations.

Foreign privacy, data protection, and security laws have become more stringent in recent years, are undergoing a period of rapid change, and increase the costs and complexity of offering our products and services in new and existing geographies. For example, the European Union’s General Data Protection Regulation 2019/679 (“the EU GDPR”), the EU GDPR as it forms part of United Kingdom (“UK”) law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”), Australia’s Privacy Act, and Canada’s Personal Information Protection and Electronic Documents Act, impose strict requirements for processing personal information. European privacy, data protection, and security laws, including the EU GDPR and UK GDPR impose significant and complex burdens on processing personal information, provide for robust regulatory enforcement, and contemplate significant penalties for noncompliance. Non-compliance with the EU GDPR and UK GDPR can trigger fines of up to the greater of €20 million (£17.5 million for the UK GDPR) or 4% of our global revenues, restrictions or prohibitions on data processing, and exposure to private right of action and enforcement mechanisms including extensive audit and inspection rights, or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. 

Globally, certain jurisdictions have enacted data residency or data localization laws and have imposed requirements for cross-border transfers of personal information. For example, the cross-border transfer landscape in Europe is complex and other countries outside of Europe have enacted or are considering enacting cross-border data transfer restrictions and laws requiring data residency or other restrictions around the location of the storage and processing of data, which could increase the cost and complexity of doing business. The EU GDPR generally restricts the transfer of personal information to countries outside of the EEA, such as the United States, which are not considered by the European Commission to provide an adequate level of privacy, data protection, and security. In addition, Swiss and UK law contain similar data transfer restrictions as the EU GDPR. Although there are currently valid mechanisms available to transfer data from the EEA and the UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges and there remains