Company: CORT
Filing Date: 2025-05-05
Form Type: 10-Q
Source: 0001628280-25-022173
Chunk: 226

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-05-05
Form: 10-Q
Item: Part II, Item 1A
Chunk 226
---
 may be subject to fines and penalties, litigation and reputational harm in connection with our European activities. From January 1, 2021, we have had to comply with the GDPR and separately the UK GDPR, which, together with the amended United Kingdom Data Protection Act 2018, retains the GDPR in United Kingdom national law, each regime having the ability to fine up to the greater of €20 million/ £17.5 million or 4 percent of global turnover. It is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term and these changes may lead to additional costs and increase our overall risk exposure. Further, on June 28, 2021, the EC adopted an adequacy decision in favor of the United Kingdom, enabling data transfers from EU member states to the United Kingdom without additional safeguards. However, the United Kingdom adequacy decision will automatically expire in June 2025 unless the EC renews or extends that decision and remains under review by the Commission during this period.

Preparing for and complying with U.S. and foreign privacy and security laws and regulations is complex and costly as it is rigorous and time intensive and requires significant resources and a review of our technologies, systems and practices, as well as those of any third-party collaborators, service providers, CROs, contractors or consultants that process or transfer personal data collected in the EU. The GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as healthcare data or other personal data from our clinical trials, and access to certain data such as the European Health Data Space Regulation, could require us to change our business practices and put in place additional compliance mechanisms, may interrupt or delay our development, regulatory and commercialization activities and increase our cost of doing business, and could lead to government enforcement actions, private litigation and significant fines and penalties against us and could have a material adverse effect on our business, financial condition or results of operations. Similarly, failure to comply with federal and state laws regarding privacy and security of personal data could expose us to fines and penalties under such laws. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.

We rely on information technology to conduct our business. A breakdown or breach of our information technology systems or our failure to protect confidential information concerning our business, patients or employees could interrupt the operation of our business and subject us to liability.

We store