Company: PENG
Filing Date: 2025-10-21
Form Type: 10-K
Source: 0001616533-25-000061
Chunk: 41

Company: Penguin Solutions, Inc.
Filing Date: 2025-10-21
Form: 10-K
Item: Item 1A
Chunk 41
---
 execute transactions and to possess, process, transmit and use personal information and data in conducting our business, for example with respect to our marketing efforts, which include email marketing and telemarketing, subjects us to legislative and regulatory obligations that, among other things, may require us to expend time, financial and other resources to monitor and interpret ever-evolving and complex data privacy and security laws.

In particular, certain states have adopted new or modified privacy and security laws and regulations that may apply to our business, for example, the California Consumer Privacy Act (“CCPA”) imposes obligations on businesses that process personal information of California residents. Among other things, the CCPA: requires disclosures to such residents about the data collection, use and disclosure practices of covered businesses; provides such individuals expanded rights to access, delete and correct their personal information and opt-out of certain transfers of personal information; requires covered businesses enter into specific contractual provisions with service providers that process California resident personal information on the covered business’s behalf; and provides such individuals with a private right of action and statutory damages for data breaches. The enactment of the CCPA has prompted a wave of similar laws being passed in the United States, which creates the potential for a patchwork of overlapping but different state laws. For example, since the CCPA went into effect, comprehensive privacy statutes that share similarities with the CCPA are now in effect and enforceable in numerous states. We cannot predict the full impact of these laws on our business or operations. Many other states are currently reviewing or proposing the need for greater regulation of the collection, sharing, use and other processing of information related to individuals for marketing purposes or otherwise, and there remains increased interest at the federal level as well. Additionally, other jurisdictions outside of the United States have or have recently enacted privacy and cybersecurity laws, such as the United Kingdom and the European Union that have enacted the UK General Data Protection Regulation and the EU General Data Protection Regulation respectively and Brazil which has enacted the Lei Geral de Proteção de Dados, creating the potential for a patchwork of overlapping but different laws.

We have incurred, and will continue to incur, significant expenses to comply with mandatory privacy and security standards and protocols under applicable laws, regulations, industry standards and contractual obligations. Despite such expenditures, we may face regulatory and other legal actions in the event of perceived or actual non-compliance with such applicable obligations. Many of these laws would also require us to notify regulators and customers, employees or other individuals of any data security breach as described above. The various data privacy enactments