Company: CRCT
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0001828962-25-000039
Chunk: 91

Company: Cricut, Inc.
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1A
Chunk 91
---
 Kingdom’s Information Commissioner’s Office issued new standard contractual clauses, or the UK SCCs, to support personal data transfers out of the United Kingdom, which went into effect in March 2022. We may, in addition to other impacts, experience additional costs associated with increased compliance burdens and be required to engage in new contract negotiations with third parties that aid in processing personal data on our behalf or localize certain data. We cannot fully predict how United Kingdom data protection laws or regulations may develop in the medium to longer term or how the EU will treat the United Kingdom with respect to data protection issues, including those relating to data transfers to and from the United Kingdom. We continue to monitor and review the impact of any resulting changes to EU or United Kingdom law, or related developments, that could affect our operations. We may incur liabilities, expenses, costs and other operational losses relating to the GDPR and privacy laws of applicable EU Member States and the United Kingdom, including in connection with any measures we take to comply with them.

In Brazil, the Lei Geral de Proteção de Dados Pessoais – Law No. 13,709/2018, or LGPD, similar in many respects to the GDPR, was enacted August 14, 2018 and entered into effect September 18, 2020. Penalties for violation of the LGPD may be up to 2% of revenue in Brazil, capped at R$50 million per violation. The LGPD applies to businesses that process the personal data of individuals located in Brazil and provides consumer rights similar to the GDPR. A Brazilian Data Protection Authority, Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados, or ANPD), has been established and has begun issuing guidance on how to interpret and implement the LGPD’s requirements. The ANPD has issued guidance regarding aspects of compliance with the LGPD, and is anticipated to issue further guidance. Our LGPD approach may be subject to further change, our compliance measures may not be fully adequate, we may expend significant time and cost in developing a privacy governance program and data transfer mechanisms in an effort to comply with the LGPD and any implementing regulations or guidance, and we may potentially face litigation or other proceedings relating to actual or alleged noncompliance with the LGPD.

Vietnam’s cybersecurity law went into effect on January 1, 2019 and includes stringent requirements regarding data localization and data transfers. On August 15, 2022, the Vietnamese government issued Decree 53, which elaborates on requirements relating