Company: QLYS
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001107843-25-000017
Chunk: 25

Company: QUALYS, INC.
Filing Date: 2025-05-06
Form: 10-Q
Item: Part I, Item 3
Chunk 25
---
 Indiana, Montana, Tennessee, Oregon, Florida, Delaware, Texas, Kentucky, New Jersey, New Hampshire, Maryland, Minnesota, Nebraska, and Rhode Island. Aspects of the CCPA, CPRA, and these other new and evolving state laws, as well their interpretation and enforcement, remain uncertain. The GDPR, CCPA, and other laws and regulations relating to privacy, data protection, and cybersecurity may be subject to new or changing interpretations by courts, and our interpretation of the law and efforts to comply with the rules and regulations of the law may be ruled invalid. We cannot predict the impact of the CCPA, CPRA, or other evolving privacy, data protection and cybersecurity obligations on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

The privacy, data protection, and cybersecurity laws and regulations we must comply with also are subject to change. For example, the United Kingdom has enacted a Data Protection Act, and has implemented legislation referred to as the "UK GDPR," which substantially implement the GDPR in the United Kingdom. This legislation provides for substantial penalties for noncompliance of up to the greater of £17.5 million or four percent of the previous year’s annual revenues. While the European Union has deemed the United Kingdom an "adequate country" to which personal data could be exported from the European Economic Area ("EEA"), this decision is required to be renewed after four years of being in effect and may be modified, revoked, or challenged in the interim, creating uncertainty regarding transfers of personal data to the United Kingdom from the EEA. It remains unclear how United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the United Kingdom will be regulated. Additionally, we have self-certified under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the United Kingdom extension to the EU-U.S. Data Privacy Framework, and have adopted certain standard contractual clauses approved by the European Commission ("SCCs") as part of our data processing agreements with regard to certain 

52

transfers of personal data from the EEA to the U.S. Both the EU-U.S. Data Privacy Framework and SCCs have, however, been subject to legal challenge. In its July 16, 2020 opinion, the CJEU imposed additional obligations on companies when relying on SCCs to transfer personal data. The European Commission has published revised SCCs addressing the CJEU