Company: DVAX
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001628280-25-049536
Chunk: 66

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-11-05
Form: 10-Q
Item: Part I, Item 3
Chunk 66
---
 data breach notification laws, subject us to mandatory corrective action, require us to verify the correctness of database contents and otherwise subject us to liability under laws and regulations that protect personal data, including, but not limited to, HIPAA, similar state data protection regulations, and the EU GDPR and UK GDPR, resulting in significant penalties; increased costs; loss of revenue; expenses of computer or forensic investigations; material fines and penalties; compensatory, special, punitive or statutory damages; litigation; consent orders regarding our privacy and security practices; requirements that we provide notices, credit monitoring services and/or credit restoration services or other relevant services to impacted individuals; adverse actions against our licenses to do business; or injunctive relief. 

Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with the 

72

new data protection rules. If we fail to comply with any such laws or regulations, we may face significant fines and penalties that could adversely affect our business, financial condition and results of operations. Furthermore, the laws are not consistent, and compliance in the event of a widespread data breach is costly.

U.S. and equivalent foreign authorities and international authorities warned businesses of increased cybersecurity threats from actors seeking to exploit the COVID-19 pandemic. If we are unable to prevent data security breaches or privacy violations or implement satisfactory remedial measures, our operations could be disrupted, and we may suffer loss of reputation, financial loss and other regulatory penalties because of lost or misappropriated information, including sensitive patient data. Moreover, failure to maintain effective internal accounting controls related to data security breaches and cybersecurity in general could impact our ability to produce timely and accurate financial statements and could subject us to regulatory scrutiny. In addition, these breaches and other inappropriate access can be difficult to detect, and any delay in identifying them may lead to increased harm of the type described above. Moreover, the prevalent use of mobile devices that access confidential information increases the risk of data security breaches, which could lead to the loss of confidential information, trade secrets or other intellectual property. While we have implemented security measures that are intended to protect our data security and information technology systems, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities including on a