Company: PBH
Filing Date: 2025-05-09
Form Type: 10-K
Source: 0001295947-25-000017
Chunk: 36

Company: Prestige Consumer Healthcare Inc.
Filing Date: 2025-05-09
Form: 10-K
Item: Item 1A
Chunk 36
---
 of our data security, including the failure to maintain the security of confidential data and information or the misappropriation of such confidential data and information, could result in an unauthorized release or transfer of customer, consumer, user or employee information, or the loss of valuable business data or cause a disruption in our business. These events could give rise to unwanted media attention, damage our reputation, damage our customer, consumer or user relationships, and result in lost sales, fines, lawsuits, remediation costs, or otherwise adversely impact the Company's results of operations and financial condition. We may also be required to expend significant capital and other resources to protect against or respond to or alleviate problems caused by a security breach. 

As we conduct our operations, we move data across national borders, and consequently we are subject to a variety of continuously evolving and developing laws and regulations in the United States and abroad regarding privacy, data protection and data security. The scope of the laws that may be applicable to us is often uncertain and may be conflicting.  Numerous local, municipal, state, federal and international law and regulations address privacy and security including but not limited to the California Online Privacy Protection Act, the Personal Information Protection and Electronic Documents Act, and the California Consumer Privacy Act. These privacy and security laws and regulations change frequently, and new legislation continues to be introduced, with over a dozen U.S. states having adopted privacy laws. In Europe, the European Union’s ("EU") General Data Protection Regulation (the “GDPR”) greatly increases the jurisdictional reach of EU law and adds a broad array of requirements for handling personal data, including the public disclosure of significant data breaches. In addition, it is important to note that many countries are following the EU in producing a broad omnibus law in relation to privacy protection. We may not be able to comply with all of these evolving compliance and operational requirements and to do so may impose significant costs that are likely to increase over time.

In addition, the rapid evolution and growing adoption of artificial intelligence ("AI") and machine learning technologies presents emerging risks to the security of our information, as well as the information of our customers and business partners.  As with cybersecurity risks, the use of AI by our employees, or by our customers and business partners, could result in the loss or unauthorized disclosure of sensitive information. 

In addition to our existing business continuity and incident response plans, which are designed to address cybersecurity incidents, the Company has implemented an internal AI policy. This policy restricts the use of AI technologies by requiring employees to obtain prior approval