Company: ASAN
Filing Date: 2025-12-02
Form Type: 10-Q
Source: 0001477720-25-000237
Chunk: 40

Company: Asana, Inc.
Filing Date: 2025-12-02
Form: 10-Q
Item: Part I, Item 3
Chunk 40
---
 and affording residents with certain rights concerning their personal information such as the right to access, correct, or delete certain personal information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal information, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the CCPA requires companies that process information of consumers, business representatives, and employees who are California residents to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain individual privacy rights. The CCPA provides for fines for intentional violations and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in other states and at the federal and local levels, and we expect more states to pass similar laws in the future. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging, and increase legal risk and compliance costs for us and the third parties with whom we work.

Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, and Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties.

Furthermore, the Federal Trade Commission and many state attorneys general continue to enforce federal and state consumer protection laws against companies and individuals for online data collection, use, dissemination, and security and privacy practices that appear to be unfair or deceptive. We also publish privacy policies, marketing materials, white papers, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning privacy, data protection, and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may become subject to investigation, enforcement actions by regulators, or other adverse consequences. 

Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents