Company: ISRG
Filing Date: 2025-01-31
Form Type: 10-K
Source: 0001035267-25-000017
Chunk: 211

Company: INTUITIVE SURGICAL INC
Filing Date: 2025-01-31
Form: 10-K
Item: Item 1A
Chunk 211
---
 TO COMPLEX AND EVOLVING LAWS AND REGULATIONS REGARDING DATA PRIVACY, DATA PROTECTION, ARTIFICIAL INTELLIGENCE, AND RESPONSIBLE USE OF DATA.

There are numerous laws and regulations that require Intuitive to protect the personal data it generates, collects, shares, and processes on behalf of itself and/or its customers. In addition to U.S. federal and state privacy laws, there are various comprehensive privacy laws across the globe that we are or may become subject to and that impact our business whether related to customers, employees, products, clinical trials, recruitment, or product research and development. We may be subject to significant consequences, including penalties, fines, restrictions on processing personal information, and/or reputational harm for a data breach or failure to comply with such legal requirements.

For example, in the EU, the GDPR requires controllers and processors of data relating to an identifiable living individual or “personal data” to adhere to certain key principles whenever accessing or processing personal data. The EU Data Protection Authorities have been active in their commitment to enforcing the GDPR. The European Data Protection Board, as well as individual member states, continues to refine requirements under the GDPR resulting in increased obligations to demonstrate compliance through policies, procedures, training, transfer impact assessments, privacy notices, and audits. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA and the United States remains uncertain. The GDPR provides that EEA member states may, in some circumstances, make their own laws that are more restrictive or prescriptive than GDPR, such as has occurred in France and Germany. Failure to comply with the requirements of the GDPR and the applicable EEA member state laws may result in significant fines, regulatory investigations, reputational damage, orders to cease/change our data processing activities, enforcement notices, assessment notices (for a compulsory audit), and/or civil claims (including class actions). Compliance with data protection obligations imposed by the GDPR and EEA member state laws may be onerous and adversely affect our business, financial condition, or results of operations.

38

We are subject to the privacy laws in our direct and indirect markets including, but not limited to, South Korea, Japan, Taiwan, India, Brazil, Canada, and the UK.

In the United States, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information