Company: TENB
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001660280-25-000034
Chunk: 33

Company: Tenable Holdings, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1A
Chunk 33
---
 could lose other sales opportunities or incur expenses that are not offset by an increase in revenue, which could harm our business.

We are subject to stringent and changing laws, regulations, rules, contractual obligations, policies, and other obligations related to data privacy and security. Our failure, or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences. 

In the ordinary course of our business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, “process”) personal data and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, and sensitive third-party information. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, rules, regulations, guidance, industry standards, external and internal privacy and security policies, contracts, and other obligations that govern the processing of personal data by us and on our behalf. 

In the United States, federal, state, and local governments have enacted numerous data privacy security laws, including data breach notification laws, data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, or collectively, the CCPA, imposes obligations on covered businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain rights related to their personal data. The CCPA applies to personal data of consumers, business representatives and employees who are California residents and provides for fines for non