Company: AIP
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001628280-25-048977
Chunk: 147

Company: Arteris, Inc.
Filing Date: 2025-11-04
Form: 10-Q
Item: Part I, Item 4
Chunk 147
---
 additional safeguards included in Executive Order 14086 signed by former President Biden on October 7, 2022, provide an adequate level of protection for personal data transferred from the European Union. The adequacy decision allows the EU-U.S. DPF to facilitate the transfer of data from Europe to the United States. We currently rely on the SCCs to transfer personal data outside the EEA and the U.K., including to the United States. As supervisory authorities issue further guidance on personal data export mechanisms, we could suffer additional costs, complaints and/or regulatory investigations or fines.

59

Further, the exit of the U.K. from the EU, often referred to as Brexit, created uncertainty with regard to data protection regulation in the U.K. The European Commission has adopted an adequacy decision in favor of the U.K., enabling data transfers from EU member states to the U.K. without additional safeguards. However, the U.K. adequacy decision will automatically expire in September 2025 unless the European Commission re-assesses and renews/ extends that decision and remains under review by the European Commission during this period. The relationship between the U.K. and the EU in relation to certain aspects of data protection law remains unclear, and it is unclear how U.K. data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the U.K. will be regulated in the long term. These changes will lead to additional costs and increase our overall risk exposure.

In addition, we are subject to evolving data privacy and security laws, rules and regulations in the PRC, particularly the Personal Information Protection Law (PIPL), Cybersecurity Law (CSL) and Data Security Law (DSL), along with their implementing regulations and standards. Consent from the data subject is required for any collection or processing of personal data, unless one of a limited number of exemptions applies. Notably, the PIPL, similar to the EU GDPR, applies extraterritorially in certain circumstances. 

The PIPL, CSL and DSL also specify rules for transferring personal information and the sui-generis category of ‘important data’ out of the PRC. Compliance with security assessments, obtaining certifications of group privacy standards by designated agencies, or entering into standard contracts (in approved form) with overseas recipients (to be filed with a PRC government agency) are among the requirements for transfer of personal data. All businesses in China additionally require government approval to transfer any amount of ‘important data’ generated within the PRC overseas. (