Company: TENB
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001660280-25-000034
Chunk: 36

Company: Tenable Holdings, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1A
Chunk 36
---
 third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. For example, some European regulators have significantly restricted some companies from transferring certain personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.

In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future. Furthermore, we are bound by other contractual 

24

obligations relating to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. Additionally, some of our customer contracts require us to host personal data locally.

We have published privacy policies, marketing materials, whitepapers, and other statements, such statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy, security, and artificial intelligence. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.

Our obligations related to data privacy and security (and customers’ data privacy expectations) are quickly becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources. These obligations may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. Existing and proposed laws and regulations can be costly to comply with, can delay or impede the development or adoption of our products and services and require significant management time and attention. Although we endeavor to comply with all data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties upon which we rely may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. If we or the third parties upon which we rely fail, or