Company: BLND
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001855747-25-000092
Chunk: 151

Company: Blend Labs, Inc.
Filing Date: 2025-11-06
Form: 10-Q
Item: Part I, Item 3
Chunk 151
---
 with new privacy rights and increase the privacy, data protection, and information security obligations of entities handling certain personal information of such consumers. In addition, some jurisdictions, such as New York, Massachusetts, and Nevada have enacted more generalized information security laws that apply to certain data that we process. The U.S. federal government also has proposed legislation relating to privacy and data security. We cannot yet fully determine the impact these or future laws, rules, regulations, and industry standards may have on our business or operations. Any such laws, rules, regulations, and industry standards may be inconsistent, subject to differing interpretations, or may conflict, or be alleged to conflict, with our current or future practices. Additionally, our customers may be subject to differing privacy laws, rules, and legislation, or self-regulatory principles, codes, or other obligations, which may cause them to require us to be bound by varying contractual requirements, including certain requirements applicable to other jurisdictions. Adherence to such contractual requirements may impact our collection, use, storage, sharing, disclosure, and processing of various types of information and may mean we become bound by, or voluntarily comply with, self-regulatory or other industry standards, or other actual or asserted obligations, relating to these matters that may further change as laws, rules, and regulations evolve. Complying with these requirements and other actual or asserted obligations, and changing our policies and practices may be onerous and costly, and we may not be able to respond quickly or effectively to regulatory, legislative and other developments. These changes may in turn impair our ability to offer our existing or planned products and services and/or increase our cost of doing business.

Additionally, we have incurred, and may continue to incur, significant expenses in an effort to comply with privacy, data protection, and information security standards and protocols imposed by law, regulation, industry standards, contractual obligations, or other actual or asserted obligations, and may face substantial challenges in our efforts to do so. We may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so. 

70

As our business grows, we may become subject to privacy, data protection, and information security laws from jurisdictions outside of the United States, potentially including the General Data Protection Regulation (“GDPR”). The GDPR governs the collection, use, disclosure, transfer or other processing of personal data of European persons. Among other things, the GDPR imposes requirements regarding the security of personal data and notification of data processing obligations to competent national