Company: NET
Filing Date: 2025-07-31
Form Type: 10-Q
Source: 0001477333-25-000137
Chunk: 506

Company: Cloudflare, Inc.
Filing Date: 2025-07-31
Form: 10-Q
Item: Part I, Item 8
Chunk 506
---
 the United States has enacted the Protecting Americans' Data from Foreign Adversaries Act (PADFA), and the U.S. Department of Justice recently released a final rule, which became effective on April 8, 2025, implementing President Biden’s February 2024 Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern”, both of which restrict the transfer of certain types of data to named jurisdictions or covered entities. We have incurred additional costs and have invested resources as we continue to monitor the impact these new regulations have on our and our customers’ business and implement changes to our practices as may be required under these regulations.

We also expect that there will continue to be new, and amendments to existing, laws, regulations, and industry standards concerning privacy, data protection, and information security proposed and enacted in the United States and various individual U.S. states. In the United States, various federal laws and regulations already apply to the collection, processing, disclosure and security of certain types of data, including the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act of 1996, and the Gramm-Leach-Bliley Act. In addition, there are also a number of recently enacted or proposed U.S. federal and state privacy and data protection bills in Congress and state legislatures across the country.

Obligations relating to privacy, data protection, and information security also are increasing in complexity outside the U.S. For example, the EU has revised its Cybersecurity Directive (NIS2), which, among other things, obligates companies to adopt or update policies and procedures on issues such as incident handling and supply chain security, implementing certain administrative measures, and requires top management’s involvement in cybersecurity risk-management measures, with top management potentially held liable for non-compliance. NIS2 provides for significant penalties for noncompliance, requiring EU member states to provide for a maximum fine level of at least €10,000,000 or 2% of annual turnover, whichever is greater. In addition, the EU’s Digital Operational Resiliency Act became effective in January 2025. This law aims to establish a universal framework for managing and mitigating information and communication technology risk that will apply to entities in the financial sector and their third-party cloud service providers.

Whether as a result of these developments or otherwise, we may continue to see more findings from regulators around the world against cloud service providers relating to