Company: DOMO
Filing Date: 2025-06-06
Form Type: 10-Q
Source: 0001628280-25-029801
Chunk: 40

Company: DOMO, INC.
Filing Date: 2025-06-06
Form: 10-Q
Item: Item 1A
Chunk 40
---
 worldwide relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II (NIS2), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the E.U. It expands the scope of the 2016 NIS Directive to include additional sectors while enforcing stricter governance and accountability requirements. NIS2 requires all 27 E.U. member states to issue implementing legislation by October 2024; however, several E.U. member states have not finalized their respective legislation and guidance. Additionally, the Digital Operational Resiliency Act (DORA) became effective on January 17, 2025, and aims to establish a universal framework for managing and mitigating information and communication technology risk that will apply to entities in the financial sector and their third-party cloud service providers.

59

Federal, state, and foreign laws, regulations, and other actual or asserted obligations relating to privacy, data protection, or cybersecurity may be interpreted and applied in manners that are, or are alleged to be, inconsistent with our practices. Any failure or perceived failure by us to comply with federal, state, or foreign laws, regulations, policies, legal or contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection, cybersecurity, marketing, or consumer communications may result in governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition. We expect that there will continue to be new laws, regulations, industry standards and other actual and asserted obligations relating to privacy, data protection, marketing, consumer communications, and cybersecurity proposed and enacted or otherwise implemented in the United States, the E.U., and other jurisdictions, and we cannot fully predict the impact such future laws, regulations, standards, and obligations may have on our business. Future laws, regulations, standards, and other actual or asserted obligations, or any changed interpretation of existing laws or regulations could impair our ability to develop and market new features and maintain and grow our customer base and increase revenue. Future restrictions on the collection, use, sharing, disclosure, or other processing of data could require us to incur additional costs or modify our platform