Company: APPN
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001441683-25-000017
Chunk: 44

Company: APPIAN CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 44
---
 the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act of 1996, the Gramm Leach Bliley Act, the California Consumer Privacy Act (as modified by the California Privacy Rights Act), or the CCPA, and other state laws relating to privacy and data security. The CCPA contains detailed requirements regarding collecting and processing personal information, imposes certain limitations on how such information may be used, and provides rights to consumers and employees that have never before been available, all of which may be imposed on us by our customers and oblige us to become more rigorous in how we treat our employees’ data. Further, the CCPA expands consumers’ rights with 

29

respect to certain sensitive personal information. Some state laws may be more stringent or broader in scope or offer greater individual rights with respect to confidential, sensitive, and personal information than federal, international, or other state laws, and such laws may differ from each other, which may complicate compliance efforts. New legislation proposed or enacted in various other states will continue to shape the data privacy environment nationally.

Internationally, the GDPR continues to place robust obligations on data processors and controllers and heavier documentation requirements for data protection compliance programs by companies in general. In addition, absent appropriate safeguards or other circumstances, the GDPR generally restricts the transfer of personal data to non-adequate countries and/or organizations outside of the European Economic Area, or EEA, such as India, Australia, Mexico, and non-certified organizations in the United States, which the European Commission does not consider to provide an adequate level of data privacy and security. We are currently certified under the EU-US Data Privacy Framework (“EU-US DPF”). The EU-US DPF requires parties relying upon that legal mechanism to comply with obligations similar to those required under GDPR, such as conducting transfer impact assessments to determine whether additional security measures are necessary to protect the at-issue personal data. Due to potential legal challenges, however, there exists some uncertainty regarding whether the new EU-US DPF will remain a valid mechanism for transfers of personal data out of the EEA.

Additionally, new EU legislation which came into force in 2023 such as the Digital Services Act (impacting online advertising), the Digital Markets Act (impacting those providing core platform services), the Data Governance Act (impacting public sector data), and the NIS2 Directive (cybersecurity) impact our own activities, those of our regulated and public sector customers, and those of our significant partners such