Company: VEEV
Filing Date: 2025-06-02
Form Type: 10-Q
Source: 0001393052-25-000042
Chunk: 22

Company: VEEVA SYSTEMS INC
Filing Date: 2025-06-02
Form: 10-Q
Item: Part I, Item 3
Chunk 22
---
 EU data subjects when transferring data to the U.S.

Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud software and data providers. For example, in 2021, China adopted the Personal Information Protection Law, which, together with the Cybersecurity Law and the Data Security Law, require companies that process personal data of China residents above certain thresholds to seek approval from the Cyberspace Administration of China (CAC) to transfer such data outside of China. In 2023, certain of our Veeva CRM customers in China were required to request such approval from the CAC and had their requests denied. Customers required to request approval may need to implement a CRM solution that does not require data to be transferred outside of China and customers not subject to the requirement may nonetheless choose to do so. While we offer the China CRM Suite, a CRM solution that does not require data to be transferred outside of China, some customers have chosen, and other customers may choose, other CRM providers, which may negatively impact our CRM business in China. Currently, approximately 2% of our total revenue is attributable to China. Additionally, as we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations.

We also expect laws, regulations, industry standards and other obligations relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security 

42Veeva Systems Inc. | Form 10-Q

Table of Contents

Directive II (NIS2), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the EU. NIS2 provides for all 27 EU member states to have issued implementing legislation by October 2024; however, several EU member states have not finalized their respective legislation and guidance.

In the United States, the U.S. Department of Health and Human Services has promulgated privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that cover protected health information (PHI) by limiting use and disclosure and giving individuals the right to access, amend, and seek accounting of disclosures of their PHI.