Company: TEAM
Filing Date: 2025-10-31
Form Type: 10-Q
Source: 0001650372-25-000068
Chunk: 380

Company: Atlassian Corp
Filing Date: 2025-10-31
Form: 10-Q
Item: Part I, Item 2
Chunk 380
---
 require altering or limiting some of our services or may require additional contractual terms to avoid liabilities for our customers’ misconduct.

We monitor the regulatory, judicial, and legislative environment and have invested in addressing these developments. These new laws may require us to make additional changes to our practices and services to enable us or our customers to meet the new legal requirements, and may also increase our potential liability exposure through new or higher potential penalties for noncompliance. In addition, changes to penalties, fines, and action related to data breaches could impact our potential liability exposure. Record-breaking enforcement actions globally have shown that regulators wield their right to impose substantial fines for violations of technology regulations, and these enforcement actions could result in guidance from regulators that would require changes to our current compliance strategy. 

Furthermore, privacy laws and regulations are subject to differing interpretations and may be inconsistent among jurisdictions. These and other requirements are causing increased scrutiny among customers, particularly in the public sector and highly regulated industries, and may be perceived differently from customer to customer. These developments could reduce demand for our services, require us to take on more onerous obligations in our contracts, restrict our ability to store, transfer and process data, require us to fundamentally change our business activities and practices or modify our products, or, in some cases, impact our ability or our customers' ability to offer our services in certain locations, to deploy our solutions, to reach current and prospective customers, or to derive insights from customer data globally. For example, in July 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S. Privacy Shield Framework, one of the mechanisms that allowed companies, including Atlassian, to transfer personal data from the EEA to the United States. Even though the CJEU decision upheld the Standard Contractual Clauses as an adequate transfer mechanism, the decision created uncertainty around the validity of all EU-to-U.S. data transfers. The EU and U.S. governments later established the EU-U.S. Data Privacy Framework to foster EU-to-U.S. data transfers and address the concerns raised in the aforementioned CJEU decision, but it is uncertain whether this framework will eventually be overturned in court like the previous two EU-U.S. bilateral cross-border transfer frameworks. The validity of the EU-U.S. Data Privacy Framework recently survived a legal challenge in September 2025 before the CJEU but this outcome does not preclude future successful challenges on other grounds. Certain countries outside of the EEA have also passed or are considering passing laws requiring varying degrees of local data