Company: QLYS
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001107843-25-000017
Chunk: 26

Company: QUALYS, INC.
Filing Date: 2025-05-06
Form: 10-Q
Item: Part I, Item 3
Chunk 26
---
 concerns on June 4, 2021, that are required to be implemented. The United Kingdom has adopted new standard contractual clauses ("UK SCCs"), that became effective as of March 21, 2022, and which also are required to be implemented. The EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, United Kingdom extension to the EU-U.S. Data Privacy Framework, revised SCCs and UK SCCs, guidance and opinions of regulators, and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of Europe, which may increase compliance costs, lead to increased regulatory scrutiny or liability, and which may adversely impact our business, financial condition and operating results. We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA, United Kingdom, Switzerland, or other jurisdictions. We may experience reluctance or refusal by current or prospective customers in these or other jurisdictions to use our products, and we and our customers may face a risk of regulatory enforcement actions or other proceedings relating to personal data transfers to us and by us from the EEA, United Kingdom, and Switzerland. Any such proceedings could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition. Some countries also are considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of delivering our services.

In addition to laws and regulations, privacy advocacy and industry groups or other private parties may propose new and different standards relating to privacy, data protection, and cybersecurity that apply, or are alleged to apply, to us. The interpretation and application of laws, regulations, standards and contractual obligations relating to these matters are uncertain, and it is possible that they may be interpreted and applied in a manner that is, or perceived to be, inconsistent with our data management practices or the features of our solutions. If so, in addition to the possibility of regulatory investigations and enforcement actions or other proceedings, fines, lawsuits and other claims, other forms of injunctive or operations-limiting relief, and damage to our reputations and loss of goodwill, we could be required to fundamentally change our business activities and practices or modify our solutions and may face limitations in our ability to develop new solutions and features, any of which could have an adverse effect on our business. Any inability to adequately address concerns relating to privacy, data protection, or cybersecurity, even if unfounded