Company: CORT
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-008167
Chunk: 23

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 23
---
 Nevada, which came into effect in 2023 and 2024. As a result, 

11

additional compliance investment and potential business process changes may be required. In the event that we are subject to or affected by HIPAA, the CCPA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. Additional legislation proposed at the federal level and in other states, along with increased regulatory action, reflect a trend toward more stringent privacy legislation in the United States.

In Europe, the General Data Protection Regulation (“GDPR”) went into effect in May 2018 and imposes stringent data protection requirements for controllers and processors of personal data of persons within the EU. The GDPR applies to any company established in the EU or the European Economic Area (“EEA”) as well as to those outside the EU or the EEA if they collect and use personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. In addition, the GDPR increases the scrutiny of transfers of personal data from clinical trial sites located in the EEA to the United States and other jurisdictions that the EC does not recognize as having “adequate” data protection laws. Transfers of personal information out of the European Union face a constantly shifting set of requirements, as courts in Europe have invalidated intergovernmental agreements. As a result, uncertainty exists with respect to GDPR compliance and the attendant obligations going forward as the regulatory environment is rapidly developing. In addition, from January 1, 2021, companies have had to comply with both the GDPR and the GDPR as incorporated into United Kingdom national law (“UK GDPR”), the latter regime having the ability to separately fine up to the greater of £17.5 million or 4% of global turnover. The EC has adopted an adequacy decision in favor of the United Kingdom, enabling data transfers from EU member states to the United Kingdom without additional safeguards. However, the UK adequacy decision will automatically expire in June 2025 unless the EC re-assesses and renews/extends that decision. Outside Europe, significant data privacy regulatory regimes exist in major markets including Brazil, India, China, and elsewhere. The ever-shifting landscape of