Company: RPID
Filing Date: 2025-11-07
Form Type: 10-Q
Source: 0001380106-25-000200
Chunk: 405

Company: RAPID MICRO BIOSYSTEMS, INC.
Filing Date: 2025-11-07
Form: 10-Q
Item: Part I, Item 8
Chunk 405
---
 for California residents and obligates covered businesses to comply with specific requirements related to data use, transparency, deletion, and opt-out of the selling or sharing of personal information. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal information than federal, international or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts. Such laws may have potentially conflicting requirements that would make compliance challenging. 

More than a dozen other U.S. states have passed their own comprehensive privacy laws with more expected to pass in the coming years. Such laws may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or adverse changes in business data collection and use practices and policies. Some states have also either passed or proposed privacy and data protection legislation specifically protecting health-related information. The existence of varying and potentially conflicting comprehensive privacy laws in different U.S. states could make our compliance obligations more complex, may require us to expend significant resources in connection with our compliance efforts and subject us to enforcement actions or otherwise incur liability for any actual or perceived noncompliance, including litigation, enforcement actions and reputational harm leading to a loss of existing and future business.

Internationally, laws, regulations and standards in many jurisdictions apply broadly to the collection, use, retention, security, disclosure, transfer and other processing of personal information. For example, with respect to the collection and processing of personal data relating to our personnel, customers and establishments in Europe, we are subject to the EU General Data Protection Regulation ("EU GDPR"), the UK General Data Protection Regulation ("UK GDPR"), as well as applicable data protection laws in effect in the Member States of the EEA and in the UK (including the UK Data Protection Act 2018) which govern the processing of personal data in connection with (a) our offering of goods or services to/the monitoring of the behavior of individuals in the UK and EEA; or (b) the activities of any of our establishments in the UK or any EEA Member State, such as our German subsidiary. In this Quarterly Report on Form 10-Q, references to “GDPR” encompass both the EU GDPR and UK GDPR, unless specific otherwise. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including  requiring disclosures to individuals regarding data processing activities, requiring that safeguards are implemented to