Company: TXG
Filing Date: 2025-05-09
Form Type: 10-Q
Source: 0001770787-25-000032
Chunk: 323

Company: 10x Genomics, Inc.
Filing Date: 2025-05-09
Form: 10-Q
Item: Part II, Item 1A
Chunk 323
---
 the standard contractual clauses, or SCCs - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On July 10, 2023, the European Commission adopted its Adequacy Decision in relation to the new EU-US Data Privacy Framework (“DPF”), rendering the DPF effective as a GDPR transfer mechanism to U.S. entities self-certified under the DPF. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Since the beginning of 2021, we have also been subject to the UK data protection regime, which imposes separate but similar obligations to those under the GDPR and comparable penalties, including fines of up to £17.5 million or 4% of a noncompliant company’s global annual revenue for the preceding financial year, whichever is greater. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government), as a data transfer mechanism from the UK to U.S. entities self-certified under the DPF. Other foreign jurisdictions, such as China and Russia, are increasingly implementing or developing their own privacy regimes with complex and onerous compliance obligations and robust regulatory enforcement powers. As we continue to expand into other foreign countries and jurisdictions, we may be subject to additional laws and regulations that may affect how we conduct business.

In the United States, the California Consumer Privacy Act of 2018 (the ”CCPA”), as amended by the California Privacy Rights Act (collectively,(the "CCPA"), requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use and disclosure of their personal information, (ii) receive and respond to requests from California residents to access, delete and correct their personal information, or to opt out of certain disclosures of their  personal information, and (iii)