Company: DNLI
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001714899-25-000193
Chunk: 136

Company: Denali Therapeutics Inc.
Filing Date: 2025-11-06
Form: 10-Q
Item: Part I, Item 3
Chunk 136
---
 (the "UK GDPR"), with substantial penalties for noncompliance.

65

Further, various states, such as California, Massachusetts, and Washington have implemented privacy laws and regulations that impose restrictive requirements regulating the use and disclosure of health information and other personal information. Where state laws are more protective than HIPAA, we must comply with the stricter provisions. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. For example, California has enacted legislation, the California Consumer Privacy Act ("CCPA"), which, among other things, requires covered companies to provide new disclosures to California consumers, and affords such consumers new abilities to opt-out of certain sales of personal information. The CCPA, as amended and expanded by the California Privacy Rights Act ("CPRA"), requires covered companies to provide new disclosures to individuals and consumers in California, and afford such individuals and consumers new data protection rights, including the ability to opt-out of certain sales of personal information. Numerous other states in the United States have proposed or enacted similar legislation. Further, some states have enacted more specific legislation, such as Washington's enactment of the My Health, My Data Act, which includes a private right of action. The U.S. federal government is also contemplating federal privacy legislation. Additionally, the U.S. Department of Justice recently implemented a final rule that places limitations, and in some cases prohibitions, on certain transfers of sensitive personal data to business partners located in China or with other specified links to China (and other designated countries). The GDPR, UK GDPR, CCPA, CPRA, and many other federal, state, and foreign laws and regulations relating to privacy and data protection are still being tested in courts, and they are subject to new and differing interpretations by courts and regulatory officials. Additionally, the interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and data we receive, use and share, potentially exposing us to additional expense, adverse publicity and liability. 

It is possible that the GDPR, UK GDPR, CCPA, CPRA, or other laws and regulations relating to privacy and data protection may be interpreted and applied in a manner that is inconsistent from jurisdiction to jurisdiction or inconsistent with our current policies and practices. We cannot guarantee that we or our vendors are in compliance with all such applicable data protection laws and regulations and we cannot be sure how these regulations will be interpreted, enforced or applied to our operations