Company: DNLI
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001714899-25-000105
Chunk: 463

Company: Denali Therapeutics Inc.
Filing Date: 2025-05-06
Form: 10-Q
Item: Part I, Item 8
Chunk 463
---
 certain sales of personal information. The CCPA, as amended and expanded by the California Privacy Rights Act ("CPRA"), requires covered companies to provide new disclosures to individuals and consumers in California, and afford such individuals and consumers new data protection rights, including the ability to opt-out of certain sales of personal information. Numerous other states in the United States have proposed or enacted similar legislation. Further, some states have enacted more specific legislation, such as Washington's enactment of the My Health, My Data Act, which includes a private right of action. The U.S. federal government is also contemplating federal privacy legislation. Additionally, the U.S. Department of Justice recently issued a final rule that takes effect in April 2025 and places limitations, and in some cases prohibitions, on certain transfers of sensitive personal data to business partners located in China or with other specified links to China (and other designated countries). The GDPR, UK GDPR, CCPA, CPRA, and many other federal, state, and foreign laws and regulations relating to privacy and data protection are still being tested in courts, and they are subject to new and differing interpretations by courts and regulatory officials. Additionally, the interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and data we receive, use and share, potentially exposing us to additional expense, adverse publicity and liability. 

It is possible that the GDPR, UK GDPR, CCPA, CPRA, or other laws and regulations relating to privacy and data protection may be interpreted and applied in a manner that is inconsistent from jurisdiction to jurisdiction or inconsistent with our current policies and practices. We cannot guarantee that we or our vendors are in compliance with all such applicable data protection laws and regulations and we cannot be sure how these regulations will be interpreted, enforced or applied to our operations. Furthermore, other jurisdictions outside the EU are similarly introducing or enhancing laws and regulations addressing privacy and data protection and security, which could increase our compliance costs and the risks associated with noncompliance. It is possible that these laws, regulations, or other actual or asserted obligations may be interpreted and applied in a manner that is inconsistent with our practices and our compliance efforts may be unsuccessful. We cannot guarantee that we or our vendors may be in compliance with all applicable international laws and regulations as currently maintained and enforced or as they evolve. Our actual or alleged non-compliance could result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business. In addition to the risks associated