Company: OTSA
Filing Date: 2025-07-16
Form Type: F-1/A
Source: 0001213900-25-064434
Chunk: 54

Company: OTSAW Ltd
Filing Date: 2025-07-16
Form: F-1/A
Chunk 54
---
 Personal Data Protection Act), we must also comply with a multitude of data security and privacy laws that may vary significantly from jurisdiction to jurisdiction. Most jurisdictions in which we operate have established or are in the process of establishing data security and privacy legal frameworks which we and our customers must comply with. As the interpretation and application of many privacy and data protection laws are uncertain, these laws may be interpreted or applied differently across jurisdictions, and in a manner that is inconsistent with our current data management practices or the features of our products. If so, in addition to the possibility of fines, lawsuits and other claims and penalties, we could be required to fundamentally change our business activities and practices or modify our products to comply with such regulations, which could have an adverse effect on our business. Furthermore, the costs of compliance with such data privacy laws, regulations, and policies that are also applicable to the businesses of our customers may limit the use and adoption of our products, reducing the overall demand. Privacy and data security concerns, whether valid or not valid, may inhibit market adoption of our products, particularly in certain industries and foreign countries. For example, in the United States, all 50 states have now passed laws to regulate the actions that a business must take in the event of a data breach, such as prompt disclosure and notification to affected users and regulatory authorities. In addition to the data breach notification laws, some states have also enacted statutes and rules requiring businesses to reasonably protect certain types of personal information they hold or to otherwise comply with certain specified data security requirements for personal information. Additionally, the U.S. federal and state governments will likely continue to consider the need for greater regulation aimed at restricting certain uses of personal data for targeted advertising. In the European Union, or EU, the General Data Protection Regulation, or GDPR, which came into effect on May 25, 28 2018, increased our burden of regulatory compliance and requires us to change certain of our privacy and data security practices. The GDPR implements more stringent operational requirements for processors and controllers of personal data, including, for example, requiring expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements, and higher standards for data controllers to demonstrate that they have obtained either valid consent or have another legal basis in place to justify their data processing activities. The GDPR further provides that EU member states may make their own additional laws and regulations in relation to certain data processing activities, which could further limit our ability to use and share personal data and could require localized changes to our operating