Company: VHC
Filing Date: 2025-08-12
Form Type: 10-Q
Source: 0001140361-25-030577
Chunk: 139

Company: VirnetX Holding Corp
Filing Date: 2025-08-12
Form: 10-Q
Item: Part I, Item 8
Chunk 139
---
 locate an individual.

We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU, and other jurisdictions.
        For example, the European Commission maintains a General Data Protection Regulation (the GDPR) that imposes stringent data protection requirements and provides for substantial penalties for noncompliance. The United Kingdom has enacted a Data
        Protection Act and legislation referred to as the UK GDPR that substantially implements the GDPR and provides for a penalty regime similar to the GDPR. The United Kingdom made targeted amendments to the Data Protection Act and the UK GDPR in the UK
        Data (Use and Access) Act, effective June 19, 2025. We may be required to incur substantial expense in order to make significant changes to our products and operations to address compliance with the GDPR and similar legislation, such as the UK GDPR
        and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation, the California Consumer Privacy Act (CCPA) that, among other things, requires covered companies to provide disclosures
        to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA was modified and expanded by the California Privacy Rights Act (CPRA), which was approved by California voters in the
        November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation. For example, Connecticut, Virginia, Utah and Colorado enacted legislation similar to the CCPA and CPRA that took
        effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has become effective in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa have enacted similar legislation that
        has or will become effective in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will become effective in 2026. The U.S. Department of Justice has also issued regulations regarding certain bulk sensitive personal
        data transfers. We cannot yet fully determine the impact these or future laws, regulations and standards may have on our business, but they may require us to modify our data processing practices and policies and to incur substantial costs and
        expenses in efforts to comply. Privacy, data protection and information security laws and regulations are often subject to differing interpretations, may be inconsistent among jurisdictions, and may be alleged to be inconsistent with our