Company: NET
Filing Date: 2025-05-08
Form Type: 10-Q
Source: 0001477333-25-000082
Chunk: 276

Company: Cloudflare, Inc.
Filing Date: 2025-05-08
Form: 10-Q
Item: Part II, Item 1A
Chunk 276
---
. stance on the existing legal framework. In addition, in January 2023, the European Data Protection Board issued its 2022 Coordinated Enforcement Action on the use of cloud-based services by the public sector, in which it expressed concerns that EU public sector entities may not be able to use U.S.-based cloud service providers consistently with GDPR due to their concerns about the ability of U.S. government agencies to access EU personal data. More recently, the European Data Protection Supervisor’s finding in March 2024 that the European Commission’s use of Microsoft 365 violates the GDPR in part due to EU personal data being transferred to countries that have not been determined by the EU to provide adequate level of protection suggests that EU regulators are continuing to subject data transfers outside the EU to careful scrutiny.

In addition, the United States has enacted the Protecting Americans' Data from Foreign Adversaries Act (PADFA), and the U.S. Department of Justice recently released a final rule, which became effective on April 8, 2025, implementing President Biden’s February 2024 Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern”, both of which restrict the transfer of certain types of data to named jurisdictions or covered entities. We likely will incur additional costs and an investment of resources as we continue to monitor the impact these new regulations will have on our and our customers’ business and implement changes to our practices as may be required under these regulations.

We also expect that there will continue to be new, and amendments to existing, laws, regulations, and industry standards concerning privacy, data protection, and information security proposed and enacted in the United States and various individual U.S. states. In the United States, various federal laws and regulations already apply to the collection, processing, disclosure and security of certain types of data, including the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act of 1996, and the Gramm-Leach-Bliley Act. In addition, there are also a number of recently enacted or proposed U.S. federal and state privacy and data protection bills in Congress and state legislatures across the country.

Obligations relating to privacy, data protection, and information security also are increasing in complexity outside the U.S. For example, the EU has revised its Cybersecurity Directive (NIS2), which, among other things, obligates companies to adopt or update policies and procedures on issues