Company: WTFCN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001015328-25-000093
Chunk: 208

Company: WINTRUST FINANCIAL CORP
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 208
---
 regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability.

We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, including in relation to the personal information of customers, employees or others, and any failure to comply with these laws, regulations, rules, standards and contractual obligations could expose us to liability and/or reputational damage. As data privacy and cybersecurity risks for banking organizations and the broader financial system have significantly increased in recent years, data privacy and cybersecurity issues have become the subject of increasing legislative and regulatory focus. As new data privacy and cybersecurity-related laws, regulations, rules and standards are implemented, the time and resources needed for us to comply with such laws, regulations, rules and standards as well as our potential liability for non-compliance and reporting obligations in the case of cyber-attacks, information security breaches or other similar incidents, may significantly increase. Compliance with these laws, regulations, rules and standards may require us to change our policies, procedures and technology, which could, among other things, make us more vulnerable to operational failures and to monetary penalties for breach of such laws, regulations, rules and standards.

In addition to various data privacy and cybersecurity laws and regulations already in place, U.S. states are increasingly adopting laws and regulations imposing comprehensive data privacy and cybersecurity obligations, which may be more stringent, broader in scope, or offer greater individual rights, with respect to personal information than federal or other state laws and regulations, and such laws and regulations may differ from each other, which may complicate compliance efforts and increase compliance costs. Certain aspects of federal and state laws and regulations relating to data privacy and cybersecurity, as well as their enforcement, remain unclear, and we may be required to modify our practices in an effort to comply with them.

Further, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, regulations, rules and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to data privacy or cybersecurity. Although we endeavor to comply with our privacy policies, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other documentation that provide promises and assurances about data privacy and cybersecurity can subject us to potential federal or state action if they are found to be deceptive, unfair, or mis