Company: BL
Filing Date: 2025-05-07
Form Type: 10-Q
Source: 0001666134-25-000016
Chunk: 123

Company: BLACKLINE, INC.
Filing Date: 2025-05-07
Form: 10-Q
Item: Part II, Item 1A
Chunk 123
---
 European Commission. More generally, uncertainty may continue about the legal requirements for transferring customer personal data to and from the EEA, UK, Switzerland, and other regions, an integral process of our business. Other countries have passed or are considering passing laws imposing varying degrees of restrictive data residency requirements, which have created additional costs and complexity, and any new requirements may result in additional costs and complexity.

In addition, the UK has established its own domestic regime with the UK GDPR and amendments to the Data Protection Act. While the UK GDPR substantially mirrors the obligations in the GDPR and imposes similar penalties, the UK government is considering amending its data protection legislation. If UK regulation of data protection diverges significantly from the EU, new obligations and data flow issues could emerge, creating costs and complexity. Actual or alleged failure to comply with the GDPR or the UK GDPR can result in private lawsuits, reputational damage, loss of customers, and regulatory enforcement actions, which can result in significant fines, including, under the GDPR, fines of up to EUR 20 million (or GBP 17.5 million under the UK GDPR) or four percent (4%) of global revenue, whichever is greater.

Further, cybersecurity laws and regulations continue to evolve worldwide. For example, the EU’s Digital Operational Resilience Act (“DORA”) creates an information and communication technology (“ICT”) risk management framework for financial institutions and their critical ICT service providers. DORA introduces obligations regarding risk assessments, technical standards, mandatory penetration testing, staff training, and incident notification. It also requires due diligence on third-party ICT service providers and the inclusion of specific provisions in ICT service agreements. DORA took effect on January 17, 2025, and compliance with the regulation may require changes in our services and related policies and practices and may require us to incur significant costs. Further, the EU revised its Cybersecurity Directive (“NIS2”), with EU member states having been obligated to transpose it into national law by October 17, 2024, but with some member states’ transpositions yet to be finalized. 

49

NIS2, among other things, obligates companies to adopt or update policies and procedures on issues such as incident handling and supply chain security, implementing certain administrative measures, and requires top management’s involvement in cybersecurity risk management measures, with top management potentially held liable for noncompliance. 

Regulatory developments in the U.S. present additional risks. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California consumers, including