Company: TIPT
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001393726-25-000028
Chunk: 114

Company: TIPTREE INC.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 114
---
 jurisdictions, or their customers, may need to comply, including, but not limited to, the EU. The EU has adopted the General Data Protection Regulation, or the GDPR, which contains numerous requirements, robust obligations on data processors and heavier documentation requirements for data protection compliance programs by companies. The GDPR imposes significant penalties for non-compliance with fines of up to 4% of total annual worldwide turnover or €20 million (whichever is higher), depending on the type and severity of the violation. In addition, following Brexit, the U.K. General Data Protection Regulation (i.e., a version of the GDPR as implemented into U.K. law) went into effect, which may expose us to burdens and risks comparable to those of the GDPR.

Because the interpretation and application of many privacy and data protection laws along with contractually imposed industry standards are uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our insurance subsidiaries’ existing data management practices or the features of their services and platform capabilities. Any failure or perceived failure by our insurance subsidiaries, or any third parties with which they do business, to comply with their posted privacy policies, changing consumer expectations, evolving laws, rules and regulations, industry standards, or contractual obligations to which they or such third parties are or may become subject, may result in actions or other claims against our insurance subsidiaries by governmental entities or private actors, the expenditure of substantial costs, time and other resources or the incurrence of significant fines, penalties or other liabilities. In addition, any such action, particularly to the extent our insurance subsidiaries were found to be guilty of violations or otherwise liable for damages, would damage their reputation and adversely affect their business, financial condition and results of operations. Even if our businesses are not determined to have violated these 

48

laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our businesses, financial condition, and results of operations.

Compliance with existing and new regulations affecting our business in regulated industries may increase costs and limit our ability to pursue business opportunities.

We are subject to extensive laws and regulations administered and enforced by a number of different federal and state governmental authorities in the industries in which we operate. Regulation of such industries may increase. In the past, there has been significant legislation affecting financial services and insurance, including the Dodd-Frank Act. In addition, we are subject to regulations governing the protection of personal confidential information and data security including the Gramm-Leach-Bliley Act, the GDPR,