Company: VEEV
Filing Date: 2025-11-21
Form Type: 10-Q
Source: 0001393052-25-000078
Chunk: 230

Company: VEEVA SYSTEMS INC
Filing Date: 2025-11-21
Form: 10-Q
Item: Part I, Item 8
Chunk 230
---
 revenue is attributable to China. Additionally, the French governmental agency for health mandates a certification requiring that personal health data collected during healthcare activities be stored exclusively within the European Economic Area.

As we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations.

We also expect laws, regulations, industry standards and other obligations relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II (“NIS2”), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the EU. NIS2 provides for all 27 EU member states to have issued implementing legislation by October 

Veeva Systems Inc. | Form 10-Q43

Table of Contents

2024; however, several EU member states have not finalized their respective legislation and guidance. Furthermore, the newly effective EU Data Act, which came into effect September 12, 2025, allows our EU customers to cancel their subscriptions without cause and switch to another provider upon providing the notice and after the transition period specified by the Act.

In the United States, the U.S. Department of Health and Human Services has promulgated privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) that cover protected health information (“PHI”) by limiting use and disclosure and giving individuals the right to access, amend, and seek accounting of disclosures of their PHI. Certain of our customers may be either business associates or covered entities under HIPAA, which means we must maintain a HIPAA compliance program. There is also the potential for the U.S. federal government to pass additional data privacy laws.

U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information, create new privacy rights for individuals, and contain enhanced requirements for and restrictions on data brokers. For example, under the California Consumer Privacy Act (“CCPA”), as amended, we are generally considered a “service provider” for our software solutions and a “business” for our data products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, passed the