Company: CORT
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001628280-25-048841
Chunk: 140

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-11-04
Form: 10-Q
Item: Part I, Item 2
Chunk 140
---
 regulate consumer health data, such as the Washington My Health My Data Act, which became effective in 2024, Nevada’s Consumer Health Data Privacy Law, which became effective in 2024, and Connecticut’s amendments to its privacy law to address health data, which became effective in 2023. As a result, additional compliance investment and potential business process changes may be required. In the event that we are subject to or affected by HIPAA, the CCPA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. Additional legislation proposed at the federal level and in other states, along with increased regulatory action, reflect a trend toward more stringent privacy legislation in the United States.

39

Outside the United States, many jurisdictions have or are in the process of enacting extensive data privacy regulations. In Europe, the GDPR took effect in 2018, and is imposing stringent data protection requirements for controllers and processors of personal data of individuals within the EEA, particularly with respect to clinical trials. The GDPR provides that EEA member states may make further laws and regulations limiting the processing of health data, which could limit our ability to use and share personal data or could cause our costs to increase and harm our business and financial condition. In addition, the GDPR increases the scrutiny that clinical trial sites located in the EEA should apply to transfers of personal data from such sites to countries that are considered to lack an adequate level of data protection, such as the United States. Legal developments have added complexity and compliance uncertainty regarding certain transfers of information from the EEA to the United States. Following EU court decisions, updated standard contractual clauses (“SCCs”) were adopted to account for these judicial decisions, imposing new requirements on data transfers. The revised SCCs must be used for relevant new data transfers from September 27, 2021, and existing SCC arrangements were required to be retired by December 27, 2022. As supervisory authorities issue further guidance on personal data export mechanisms, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. Further, on July 10, 2023, the European Commission adopted its adequacy decision on the E.U.-U