Company: CRD-A
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030894
Chunk: 18

Company: CRAWFORD & CO
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 18
---
 determine the potential materiality of a cybersecurity incident. These procedures include reporting protocols to and oversight from our Board of Directors. We also have disclosure controls and insider trading restrictions that would apply in the event of a material cybersecurity incident, and we routinely perform simulations and drills at both a technical and management level. Notwithstanding these measures, we cannot provide any assurance that we will always be able to prevent or mitigate a cybersecurity attack. These types of cybersecurity attacks and incidents can give rise to a variety of losses and costs, including legal exposure and regulatory fines, damages to reputation, and others. 

7

Increasing regulatory focus on privacy issues and expanding laws could impact our business models and expose us to increased liability.

U.S. privacy and data security laws apply to our various businesses. We also do business globally in countries that have stringent data protection laws that may be inconsistent across jurisdictions and are subject to evolving and differing interpretations. Furthermore, data privacy advocate groups are evolving industry standards regarding data privacy. Governments, privacy advocates and class action attorneys are increasingly scrutinizing how companies collect, process, use, store, share and transmit personal data. In the U.S. and globally, new and evolving laws continue to be implemented with an increasing focus on individual rights and an increasing number of jurisdictions have omnibus consumer privacy laws. These requirements and industry standards, among others, may force us to bear the burden of more onerous obligations in our customer contracts and we continue to see an increased level of scrutiny from customers on data protection, governance, and security.

Any perception of our practices, products or services as a violation of individual privacy rights may subject us to public criticism, class action lawsuits, reputational harm, or investigations or claims by regulators, industry groups or other third parties, all of which could disrupt our business and expose us to increased liability. Additionally, we collect, process and store information at the direction of and on behalf of our customers and if our customers fail to comply with their own contractual obligations or applicable laws, it could result in litigation or reputational harm to us. 

Transferring personal information across international borders is increasingly complex and subject to a growing body of enforcement decisions. The increased focus on cross-border data transfers in various countries, in addition to new data protection and privacy laws, means our clients are also more attune to data sharing and requiring data transfer impact assessments for countries which are not deemed to provide an adequate level of protection as the data-originating country. These requirements are often complex, conflicting, unclear or ever changing, all of which can make