Company: DOMO
Filing Date: 2025-04-04
Form Type: 10-K
Source: 0001505952-25-000045
Chunk: 77

Company: DOMO, INC.
Filing Date: 2025-04-04
Form: 10-K
Item: Item 1A
Chunk 77
---
.

Other jurisdictions have adopted laws and regulations addressing privacy, data protection, and cybersecurity, many of which share similarities with the GDPR. For example, Law no. 13.709/2018 of Brazil, the Lei Geral de Proteção de Dados 

44

Pessoais (LGPD) entered into effect in 2020, authorizing a private right of action for violations. Penalties include fines of up to 2% of the organization’s revenue in Brazil in the previous year or 50 million Brazilian reais. The LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users who are located in Brazil. The LGPD provides users with similar rights as the GDPR regarding their data. Additionally, the Personal Information Protection Law (PIPL) of the People’s Republic of China (PRC) was adopted and went into effect in 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and obligations to provide certain notices and rights to PRC citizens. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company’s revenue in the prior year.

Additionally, we may be or become subject to data localization laws mandating that data collected in a foreign country be processed only within that country. These or other laws relating to privacy or data protection could require us to expand data storage facilities in foreign jurisdictions or to obtain new local data storage in such countries. The expenditures this would require, as well as costs of compliance generally, could harm our financial condition. The regulatory environment applicable to the collection, use, and other processing of, and security measures with respect to, personal data of residents of the E.U., United Kingdom, Switzerland, Brazil, the PRC, and other foreign jurisdictions, and our actions taken in response, may cause us to be required to undertake additional contractual negotiations, modify policies and procedures, and otherwise to assume additional liabilities or incur additional costs, and could result in our business, operating results, and financial condition being harmed. 

We enter into business associate agreements with our customers who require them in order to comply with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act, and therefore we are directly subject to certain provisions of HIPAA applicable to business associates. We may collect and process protected health information as part of our designated service, which may subject us to