Company: VEEV
Filing Date: 2025-03-24
Form Type: 10-K
Source: 0001393052-25-000022
Chunk: 389

Company: VEEVA SYSTEMS INC
Filing Date: 2025-03-24
Form: 10-K
Item: Item 1
Chunk 389
---
 federal government to pass additional data privacy laws.

Veeva Systems Inc. | Form 10-K19

Table of Contents

U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information, create new privacy rights for individuals, and contain enhanced requirements for and restrictions on data brokers. For example, under the California Consumer Privacy Act (CCPA), as amended, we are generally considered a “service provider” for our software solutions and a “business” for our data products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, passed the My Health My Data Act, which became effective on March 21, 2024, establishing significant new restrictions on how businesses can collect, use, and disclose consumer health data. Veeva Crossix’s data platform combines large-scale data sets, inclusive of de-identified health and consumer data, to provide insights, analytics, and audience segmentation for our life sciences customers in the U.S. In response to the Washington law, we made modifications to our audience segments that may reduce demand for our Crossix products, which, in turn, could adversely impact the business. Other states have considered, and in certain cases enacted, similar laws. Additionally, the U.S. Department of Justice recently issued a final rule that takes effect on April 8, 2025, and places limitations, and in some cases prohibitions, on certain transfers of sensitive personal data to data to business partners located in China or with other specified links to China and other designated countries. These various laws, regulations, and legislative developments have potentially far-reaching consequences and have and may continue to require us to modify our solutions and data management practices and incur substantial expense in order to comply.

In addition to governmental laws and regulations, privacy advocates and other key industry players have, and may continue to, establish various new standards and certifications, such as the prohibition of third-party cookies and other identifiers in certain digital environments, that may place additional burdens or resource constraints on us, limit our ability to collect, use, and otherwise process certain data, and limit our ability to generate certain analytics. Our customers may expect us to meet voluntary certifications or adhere to other standards established by third parties. Understanding and implementing industry and customer specific requirements and certifications on top of our internationally recognized security certifications could require additional investment and management attention and may subject us to significant liabilities if we are unable to comply. Moreover