Company: CVLT
Filing Date: 2025-05-05
Form Type: 10-K
Source: 0001169561-25-000034
Chunk: 28

Company: COMMVAULT SYSTEMS INC
Filing Date: 2025-05-05
Form: 10-K
Item: Item 1A
Chunk 28
---
 laws, regulations, and industry standards govern data privacy and security. For example, the European Union’s ("E.U.") General Data Protection Regulation ("E.U. GDPR") and the Digital Operational Resilience Act (“DORA”), and the United Kingdom’s ("U.K.") GDPR ("U.K. GDPR"), impose strict requirements for processing the personal data of individuals. Violations of these obligations carry significant potential consequences. For example, under the E.U. GDPR, government regulators may impose temporary or definitive bans on processing, as well as fines of up to €20 million or 4% of the annual global revenue, whichever is greater. Additionally, new and emerging data privacy regimes may be applicable in Asia, including India's Digital Personal Data Protection Act, China's Personal Information Protection Law, Japan's Act on the Protection of Personal Information, and Singapore's Personal Data Protection Act. Countries are enacting stricter data localization requirements, compelling companies to store data within specific jurisdictions, which complicates global operations and increases compliance costs.

In addition, as a technology provider, our customers expect us to demonstrate compliance with current data privacy laws and further make contractual commitments and implement processes to enable the customer to comply with their own obligations under data privacy laws, and our actual or perceived inability to do so may adversely impact sales of our products and services, particularly to customers in highly regulated industries.

21

Our actual or perceived failure to comply with laws, regulations, contractual commitments, or other actual or asserted obligations, including certain industry standards, regarding personal information, or other confidential information of individuals could lead to costly legal action, brand and reputational damage, significant liability, inability to process data, and decreased demand for our services, which could adversely affect our business. In addition, any security breach that results in the release of, or unauthorized access to, personal information, or other confidential information of individuals could subject us to incident response, notice and remediation costs. Failure to safeguard data adequately or to destroy data securely could subject us to regulatory investigations or enforcement actions under applicable data security, unfair practices or consumer protection laws which could have an adverse effect on our business, financial condition or operating results. The scope and interpretation of these laws could change and the associated burdens and our compliance costs could increase in the future.

Changes in tax laws or tax rulings could materially affect our financial position, results of operations, and cash flows.

The tax regimes in which we are subject or under which we operate are constantly facing changes in tax laws, regulations, or rulings, or changes in interpretations of existing laws