Company: BL
Filing Date: 2025-11-07
Form Type: 10-Q
Source: 0001628280-25-050628
Chunk: 83

Company: BLACKLINE, INC.
Filing Date: 2025-11-07
Form: 10-Q
Item: Part I, Item 4
Chunk 83
---
 “UK DPF Extension”) and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”), are available for companies to use to legitimize personal data transfers to the U.S. from the EEA, Switzerland, and UK. We have certified to the U.S. Department of Commerce that we adhere to the DPF, UK DPF Extension, and Swiss-U.S. DPF. However, the DPF has been subject to a legal challenge, and it, the UK DPF Extension, and the Swiss-U.S. DPF may be subject to legal challenges in the future from privacy advocacy groups or others. The European Commission's adequacy decision regarding the DPF also provides that the DPF will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations in scope by the European Commission. More generally, uncertainty may continue about the legal requirements for transferring customer personal data to and from the EEA, UK, Switzerland, and other regions, an integral process of our business. Other countries have passed or are considering passing laws imposing varying degrees of restrictive data residency requirements, which have created additional costs and complexity, and any new requirements may result in additional costs and complexity.

In addition, the UK has established its own domestic regime with the UK GDPR and amendments to the Data Protection Act. While the UK GDPR imposes obligations and penalties similar to the GDPR, the UK government enacted the UK Data (Use and Access) Act 2025 on June 19, 2025, which made targeted amendments to the UK GDPR and the Data Protection Act. This has introduced additional compliance complexity and has created 

55

uncertainty with respect to the European Commission’s adequacy determination regarding the UK’s data protection regime, which must be renewed in 2025 to permit ongoing relatively unrestricted data flows from the EEA to the UK. Further, if UK regulation of data protection diverges further from the EU, new obligations and data flow issues could emerge, creating costs and complexity. Actual or alleged failure to comply with the GDPR or the UK GDPR can result in private lawsuits, reputational damage, loss of customers, and regulatory enforcement actions, which can result in significant fines, including, under the GDPR, fines of up to EUR 20 million (or GBP 17.5 million under the UK GDPR) or four percent (4%) of global revenue, whichever is greater.

Further, cybersecurity laws and regulations continue to evolve worldwide. For example, the EU’s Digital Operational Resilience Act (“DORA