Company: RRGB
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001171759-25-000012
Chunk: 23

Company: RED ROBIN GOURMET BURGERS INC
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 23
---
 increasingly demanding, with the frequent imposition of new and constantly changing requirements including the California Consumer Privacy Act, the California Privacy Rights Act, and other similar legislative initiatives. Compliance with these requirements may result in cost increases due to necessary system changes and the development of new administrative processes, and if we fail to comply, we could be exposed to risks of fines, investigations, litigation, and disruption of our operations.

In the ordinary course of our business, we receive and maintain certain personal and payment information from our Guests, Team Members, and vendors. Third parties may have the technology or know-how to breach the security of this personal and payment information. Although we employ cybersecurity measures to try to prevent cybersecurity incidents, we have in the past and could be impacted by cyber incidents or data breaches. We have in the past been subject, and we could in the future become subject, to claims, lawsuits, or other proceedings for purportedly fraudulent transactions arising from the unauthorized use of personal and payment information from our Guests, Team Members, and vendors. Any such cyber incident or data breach could disrupt the operation of our restaurants, adversely affect our reputation, and result in significant unplanned losses and expenditures.

We maintain a separate insurance policy covering cyber security risks and such insurance coverage may, subject to policy terms and conditions, cover certain aspects of cyber risks, but is subject to a retention amount and may not be applicable to a particular incident or otherwise may be insufficient to cover all our losses beyond any retention. Further, in light of recent court rulings and amendments to policy forms, there is uncertainty as to whether traditional commercial general liability policies will be construed to cover the expenses related to a cyber-attack and breaches if credit and debit card information is stolen.

Because of the number of credit card transactions we process, we are required to maintain the highest level of PCI Data Security Standard compliance at our Restaurant Support Center and Company-owned restaurants.  If we do not maintain the required level of PCI compliance, we could be subject to costly fines or additional fees from the card brands that we accept or lose our ability to accept those payment cards. Our franchisees are separate businesses that have different levels of compliance required depending on the number of credit card transactions processed. If our franchisees fail to maintain the appropriate level of PCI compliance or they experience a security breach, it could negatively impact their business operations, and we could face a loss of or reduction in royalties or other payments they are required to remit to us and it could adversely affect our reputation and Guest confidence.

11

Table of Contents

If there is