Company: WIT
Filing Date: 2025-05-22
Form Type: 20-F
Source: 0000950170-25-076303
Chunk: 23

Company: WIPRO LTD
Filing Date: 2025-05-22
Form: 20-F
Item: Item 3
Chunk 23
---
 CCPA imposes obligations on companies that process California residents’ personal information, including obligations to provide certain disclosures to such residents, and creates new consumer rights, including relating to the access to, deletion of and sharing of personal information collected by covered businesses. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. Additionally, the California Privacy Rights Act (“CPRA”) was approved by California voters in the November 3, 2020 election. Effective starting January 1, 2023, the CPRA significantly modified the CCPA and created a new state agency vested with authority to implement and enforce the CCPA and the CPRA. Numerous other states have proposed, and in certain cases enacted, legislation similar to the CCPA and CPRA. The U.S. federal government also is contemplating federal privacy legislation.
Furthermore, India passed the Digital Personal Data Protection Act in August 2023 (the “DPDP Act”), the country’s first comprehensive data protection law, the impacts of which potentially may be far-ranging and impactful upon our business, and which is anticipated to provide for substantial penalties. The DPDP Act will come into effect on such date as India’s central government may determine, with different dates of effectiveness determined for different provisions. We expect the DPDP Act to add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, and could result in increased compliance costs or changes in business practices and policies.
As a general matter, the laws, rules, regulations, standards, and other actual and asserted obligations relating to privacy, data protection and cybersecurity to which we may be subject, or that otherwise apply to our business, are constantly evolving, and we expect that there will continue to be new proposed laws, regulations and industry standards concerning these matters in India, the EU, the U.K., the U.S. and other jurisdictions in which we operate, both general and in relation to technological and other developments, including AI (and including, in particular, the EU’s AI Act), the use of algorithms and automated decision making, digital identity, and blockchain technologies. We also anticipate remaining to be subject to related contractual obligations that may be burdensome and which, in many cases, may provide for liability that is unlimited. We cannot fully predict the impact of laws, rules, and regulations, including those that may be