Company: CALX
Filing Date: 2025-07-22
Form Type: 10-Q
Source: 0001406666-25-000035
Chunk: 193

Company: CALIX, INC
Filing Date: 2025-07-22
Form: 10-Q
Item: Part I, Item 3
Chunk 193
---
 collect, process or control personal data of individuals. Although we currently do not have material operations or business in the EU or the UK, we are in the process of expanding in these jurisdictions, and we have incurred and will continue to incur substantial costs in this respect. Furthermore, the GDPR imposes significant penalties for noncompliance which can amount to the greater of €20 million (for the EU GDPR) or £17.5 million (for the UK GDPR) or 4% of the total worldwide annual turnover of the preceding financial year; thus, any non-compliance with the GDPR could result in a material adverse effect on our business, financial condition and results of operations.

40

Table of Contents

The EU GDPR and UK GDPR regulate cross-border transfers of personal data out of the European Economic Area, or the EEA, and the UK. There is currently legal complexity and uncertainty regarding international personal data transfers, and we expect this to continue. In particular, we expect the European Commission approval of the current EU-US Data Privacy Framework for data transfers to certified entities in the U.S. to be challenged and international transfers to the U.S. and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers further develops, our business, operations and financial condition could be adversely affected and we could suffer additional costs, complaints and/or regulatory investigations or fines. We may also have to stop using certain tools and vendors and make other operational changes. Further, our customers may not use our services in a manner that is compliant with applicable data privacy laws and regulations and our services may not be competitive in certain markets. We and/or our customers are also subject to evolving EU and UK privacy laws on cookies, tracking technologies, e-marketing and electronic communications. Recent European court and regulator decisions are driving increased attention to cookies and tracking technologies. If the trend of increasing enforcement by regulators of the strict approach to opt-in consent for all but essential use cases, as seen in recent guidance and decisions continues, this could lead to substantial costs, require significant systems changes, limit the effectiveness of marketing activities conducted on behalf of our customers, divert the attention of our technology personnel, adversely affect our margins, and subject us to additional liabilities. In addition, security regulations such as the EU’s Network and Information Security 2 Directive (NIS2) and its EU Member State transpositions, and the UK’s Telecommunications (Security) Act 2021 together with its implementing regulations impose further security obligations, including