Company: CRL
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001100682-25-000011
Chunk: 61

Company: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 61
---
 within the EU and European Economic Area (EEA). EU member states may also impose additional requirements in relation to personal data through their national implementing legislation. 

The EU GDPR also imposes specific restrictions on the transfer of personal data to countries outside of the EU and EEA, including the use of appropriate safeguards to enable such transfers, such as Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF). Although these mechanisms are currently valid for purposes of transferring personal data, they could be subject to legal challenges and there is no assurance that we could satisfy or rely on these measures to lawfully transfer personal data. If we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. While we have implemented controls and procedures to comply with the requirements of the EU GDPR, such procedures and controls may not be effective in ensuring compliance or preventing unauthorized transfers of personal data. 

Additionally, we are subject to the privacy and data protection laws of the UK, including the UK Data Protection Act of 2018 (UK GDPR). Similar to the EU GDPR, the UK GDPR imposes restrictions on the processing of personal data, as well as transfers of personal data from the UK to other countries. Failure to comply with the EU and/or the UK GDPR can result in significant fines and other liability.

Moreover, we are subject to the privacy and data protection laws of China, including the Personal Information Protection Law (PIPL) and Data Security Law (DSL), which promulgated requirements relating to the collection, processing, transfer and security of personal information in or from China. Violations of the PIPL or DSL could result in fines and penalties, suspension of data transfers, cancellation of business authorizations, personal liability for responsible company officers, as well as criminal and civil liability. In the event that the PIPL requires us to store data in China, or limits our ability to transfer data across borders, we may experience increased costs and business inefficiencies. Fines, corrective actions, or other penalties asserted due to alleged noncompliance may impose additional financial or operational costs, limit our ability to attract and retain local talent, or limit our ability to do business in China.

In the US, there are numerous federal and state data privacy and security laws, rules, and regulations governing the collection, use, disclosure, retention, security, transfer, storage and other processing