Company: TALK
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000950170-25-038107
Chunk: 53

Company: Talkspace, Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1A
Chunk 53
---
 health), and we must comply with these local laws where we offer our services. 

The GDPR also imposes strict rules on the transfer of personal data out of the EEA and the UK, including to the United States. The European Commission has published revised standard contractual clauses for data transfers from the EEA: the revised clauses must be used for relevant new data transfers from September 27, 2021; existing standard contractual clauses arrangements must be migrated to the revised clauses by December 27, 2022. We will be required to implement the revised standard contractual clauses within the relevant time frames. The revised standard contractual clauses apply only to the transfer of personal data outside of the EEA and not the UK; the UK’s Information Commissioner’s Office launched a public consultation on its draft revised data transfers mechanisms in August 2021. We continue to monitor updates and we may be required to implement new or revised documentation and processes in relation to our data transfers subject to the UK GDPR, within the relevant time frames. As supervisory authorities issue further guidance on data export mechanisms, including circumstances where the standard contractual clauses cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal information between and among countries 

28

and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

The relationship between the UK and the EU in relation to certain aspects of data protection law, particularly transfers of personal data, remains unclear following the UK’s departure from the EU on January 1, 2021, and it is unclear how UK data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the UK will be regulated in the long term. These changes will lead to additional costs and increase our overall risk exposure.

Failure to comply with the requirements of the GDPR may result in fines of up to €20,000,000/ £17.5 million or up to 4% of our total worldwide annual revenue for the preceding financial year, whichever is higher. In addition, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease/ change our processing of our data, enforcement notices, and/ or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm),