Company: DOMO
Filing Date: 2025-04-04
Form Type: 10-K
Source: 0001505952-25-000045
Chunk: 78

Company: DOMO, INC.
Filing Date: 2025-04-04
Form: 10-K
Item: Item 1A
Chunk 78
---
 a number of data protection, security, privacy, and other government- and industry-specific requirements. In addition, if we are unable to comply with our obligations relating to the protection and processing of protected health information, we could be found to have breached our contracts with customers with whom we have a business associate relationship. Noncompliance with laws and regulations relating to privacy and security of personal information, including HIPAA, or with contractual obligations, including under any business associate agreement, may lead to significant fines, civil and criminal penalties, and other liabilities. The U.S. Department of Health and Human Services (HHS) audits the compliance of business associates and enforces HIPAA privacy and security standards. HHS enforcement activity has increased in recent years and HHS has signaled its intent to continue this trend. Implementing rules under HIPAA addressing privacy, and a related statute addressing security, are the subject of final and proposed modifications, respectively. In addition to HHS, state attorneys general are authorized to bring civil actions seeking either injunctions or damages to the extent violations implicate the privacy of state residents.

We expect laws, regulations, industry standards and other obligations worldwide relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II (NIS2), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the E.U. It expands the scope of the 2016 NIS Directive to include additional sectors while enforcing stricter governance and accountability requirements. NIS2 requires all 27 E.U. member states to issue implementing legislation by October 2024; however, several E.U. member states have not finalized their respective legislation and guidance. Additionally, the Digital Operational Resiliency Act (DORA) became effective on January 17, 2025, and aims to establish a universal framework for managing and mitigating information and communication technology risk that will apply to entities in the financial sector and their third-party cloud service providers.

Federal, state, and foreign laws, regulations, and other actual or asserted obligations relating to privacy, data protection, or cybersecurity may be interpreted and applied in manners that are, or are alleged to be, inconsistent with our practices. Any failure or perceived failure by us to comply with federal, state, or foreign laws, regulations, policies, legal or contractual obligations, industry standards, regulatory guidance or other