Company: RSKD
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001851112-25-000006
Chunk: 30

Company: RISKIFIED LTD.
Filing Date: 2025-03-06
Form: 20-F
Item: Item 3
Chunk 30
---
ational damage.

U. S. state laws in this area are complex and developing rapidly. Many state legislatures have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security and data breaches. Laws in all 50 states require businesses to provide notice to consumers whose Personal Information has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is costly. States are also constantly amending existing laws, requiring attention to frequently changing regulatory requirements.

The California Consumer Privacy Act, or the CCPA, among other things, gives California residents rights over their Personal Information, provides for civil penalties for violations (as well as a private right of action certain for data breaches) and establishes a dedicated California privacy regulator, the California Privacy Protection Agency. Following the enactment of the CCPA, numerous comprehensive privacy statutes that share similarities with the CCPA have been enacted or are being considered in a number of states. Any failure or perceived failure by us to comply with these laws could result in proceedings or actions against us.

These laws demonstrate a trend toward more stringent privacy legislation in the United States, which could increase our potential liability and adversely affect our revenues, our results of operations and financial condition.

European Economic Area, United Kingdom and Israel.

The European Economic Area’s (“ EEA”) and United Kingdom’s data protection landscape is evolving, resulting in possible significant and operational costs for internal compliance and risks to our business.

The General Data Protection Regulation 2016/679 (the “ EU GDPR”), and the UK Data Protection Act 2018 and the UK General Data Protection Regulation (together the “ UK GDPR”) (the EU GDPR and UK GDPR together referred to as the “ GDPR”), impose robust obligations on controllers and processors for the processing of Personal Information. Failure to comply with these obligations can result in significant fines and other liability under applicable law. In particular, since we are under the supervision of relevant data protection authorities in both the EEA and the United Kingdom, we may be fined under both the EU GDPR and UK GDPR in respect of the same breach. Additional enforcement action may be taken, such as enforcement notices, assessment notices (for a compulsory audit), orders to cease/change our data processing activities. Further adverse consequences of an infringement of the GDPR may include civil

claims for material and immaterial damages from the affected individuals. Implementing legislation of individual Member States also provides for criminal sanctions for specific violations, which may also entail the loss of any profits realized as a result of infring