Company: CHEF
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001517175-25-000002
Chunk: 57

Company: Chefs' Warehouse, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 57
---
 the costs to make these changes may exceed our estimates and will likely exceed any benefits that we realize during the early stages of implementation. Even if we are able to implement the changes as planned, and within our cost estimates, we may not be able achieve the expected efficiencies, cost savings and operational enhancements from these investments which could have an adverse effect on our business, financial condition or results of operations.

Our failure to comply with data privacy regulations could adversely affect our business.

There are new and emerging data privacy laws, as well as frequent updates and changes to existing data privacy laws, in most jurisdictions in which we operate. Given the complexity of these laws and the often-onerous requirements they place on businesses regarding the collection, storage, handling, use, disclosure, transfer, and security of personal data, it is important for us to understand their impact and respond accordingly. Failure to comply with data privacy laws can result in substantial fines or penalties, legal liability and/or reputational damage.

The California Consumer Privacy Act of 2018 (the “CCPA”), which went into effect on January 1, 2020, imposes additional obligations on companies regarding the handling of personal information and provides certain individual privacy rights to persons whose information is collected. For example, the California Privacy Rights Act (the “CPRA”), which was approved by California voters as a ballot initiative in November 2020, modifies the CCPA significantly, further enhancing and extending an individual’s rights over their personal data and the obligations placed on companies that handle this data. The resulting new regulations became effective on January 1, 2023. Most notably, employee and business data were brought into scope, which raises the compliance requirements for us significantly, in terms of internal controls, processes and governance requirements.

Furthermore, since 2020, several other U.S. states have enacted (and additional U.S. states are considering enacting) stringent consumer privacy laws, which may impose varying standards and requirements on our data collection, use and processing activities. Continued state by state introduction of privacy laws can be expected to lead to significantly greater complexity in our compliance requirements globally, which could result in complaints from data subjects and/or action from regulators. If we do not provide sufficient resources to ensure we are able to respond, adapt and implement the necessary requirements to respond to the various forthcoming changes, which could include federal data privacy requirements in the U.S., while continuing to maintain our compliance with global data privacy laws, this could adversely impact our reputation and we could face exposure to fines levied by regulators, which