Company: ACIW
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000935036-25-000006
Chunk: 100

Company: ACI WORLDWIDE, INC.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 100
---
 services to financial institutions, we may be bound by the same limitations on disclosure of the information we receive from our customers as apply to the financial institutions themselves. The processing of personal data and other types of information subjects us to a number of domestic and international laws that govern and regulate the processing of personal information and other types of protected data. These laws regulate and address a range of issues including data privacy (e.g., restrictions or technological or process requirements regarding the processing of data), cybersecurity (e.g., requirements for the protection of personal information against compromise of the confidentiality, integrity, or availability of personal information), breach notification, and data governance. These laws can vary substantially from jurisdiction to jurisdiction, and are rapidly evolving. We are subject to laws and regulations relating to the collection, use, retention, privacy, protection, security, and transfer of information, including personal information of our employees and customers. These laws and regulations may change or be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible they will be interpreted and applied in ways that will materially and adversely affect our business. These laws and other developments relating to cross-border data transfer could result in increased costs of compliance and limitations on our customers and us. If we fail to comply with applicable laws and regulations, including the EU GDPR, CCPA, and other laws, we could be exposed to regulatory investigations and actions, lawsuits for breach of contract or to governmental or consumer claims, our customer relationships and reputation could be harmed, and we could be inhibited in our ability to obtain new customers. Compliance with these and new laws could involve substantial expenses and divert resources from other initiatives and projects. More restrictive privacy, data protection and cybersecurity laws adopted in the future could have an adverse impact on our business.

U.S. and other banking agencies have adopted or proposed enhanced cyber risk management standards that would apply to us and our financial institution clients and that would address cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience, and situational awareness. Several states in the U.S. have adopted or proposed new privacy and cybersecurity laws targeting these issues. Legislation and regulations on cybersecurity, data privacy, data protection and data localization may compel us to need to modify our systems, invest in new systems or alter our business practices or our policies on data governance and privacy. These actions could significantly increase our operational costs. 

Our risk management and information security programs are subject to oversight and periodic reviews by governmental agencies that regulate our business. In the event an examination of our information security