Company: INFY
Filing Date: 2025-07-01
Form Type: 20-F
Source: 0000950170-25-091925
Chunk: 27

Company: Infosys Ltd
Filing Date: 2025-07-01
Form: 20-F
Item: Item 3
Chunk 27
---
 events could jeopardize projects that are critical to the operations of our clients’ businesses. The theft and/or unauthorized use or publication of our, or our clients, confidential information or other proprietary business information as a result of such an incident could adversely affect our reputation and competitive position. Any failure in the networks or computer systems used by us or our clients could result in a claim for substantial damages against us and significant reputational harm. Many of our client agreements do not limit our potential liability for breaches of confidentiality.

As a global service provider with clients in a broad range of industries, we often have access to or are required to manage, utilize, collect and store sensitive data subject to various regulatory regimes, including but not limited to U.S. federal and state laws governing the protection of personal financial and health data and the General Data Protection Regulation (“GDPR”) . These laws and regulations are increasing in complexity and number and change frequently. Scope and coverage of these regulations are vast and include various stakeholders that do not necessarily restrict applicability to a certain geography in which we operate, which may result in greater compliance risk and cost. If any person, including any of our employees, negligently disregards or intentionally breaches our established controls with respect to our data or client data, or otherwise mismanages or

misappropriates that data, we could be subject to significant litigation, monetary damages, regulatory enforcement actions, fines and/or criminal prosecution in one or more jurisdictions in addition to significant damage to our reputation. The monetary damages might not be subject to a contractual limit of liability or an exclusion of consequential or indirect damages and could be significant. In addition, our liability insurance, which includes cyber insurance, might not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches. Similarly, many of our contracts involve projects that are critical to the operation of our clients’ businesses and provide benefits which may be difficult to quantify.
Any failure in a client’s system or breaches of security, regardless of our responsibility for such failure or breach, could result in a claim for substantial damages against us and force us to incur significant expense for our defense or could require that we pay large sums in settlement. If unauthorized access to or disclosure of such data in our possession or control occurs or we otherwise fail to comply with applicable laws and regulations in this regard, we could be exposed to civil or criminal enforcement actions and penalties in connection with any violation of applicable data protection laws, as well as lawsuits brought by our clients, our clients’ clients, their