Company: QLYS
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001107843-25-000038
Chunk: 109

Company: QUALYS, INC.
Filing Date: 2025-11-04
Form: 10-Q
Item: Part II, Item 1A
Chunk 109
---
 from the European Economic Area ("EEA"), this decision is required to be renewed in 2025 and may be modified, revoked, or challenged in the interim, creating uncertainty regarding transfers of personal data to the United Kingdom from the EEA, particularly in light of modifications to the Data Protection Act and UK GDPR in the Data (Use and Access) Bill, which received Royal Assent on June 19, 2025, and aims to modernize and streamline the UK's data protection framework. It remains unclear how United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the United Kingdom will be regulated. Additionally, we have self-certified under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the United Kingdom extension to the EU-U.S. Data Privacy Framework, and have adopted certain standard contractual clauses approved by the European Commission ("SCCs") as part of our data processing agreements with regard to certain transfers of personal data from the EEA to the U.S. Both the EU-U.S. Data Privacy Framework and SCCs have, however, been subject to legal challenge. In its July 16, 2020 opinion, the CJEU imposed additional obligations on companies when relying on SCCs to transfer personal data. The European Commission has published revised SCCs addressing the CJEU concerns on June 4, 2021, that are required to be implemented. The United Kingdom has adopted new standard contractual clauses ("UK SCCs"), that became effective as of March 21, 2022, and which also are required to be implemented. The EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, United Kingdom extension to the EU-U.S. Data Privacy Framework, revised SCCs and UK SCCs, guidance and opinions of regulators, and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of Europe, which may increase compliance costs, lead to increased regulatory scrutiny or liability, and which may adversely impact our business, financial condition and operating results. We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA, United Kingdom, Switzerland, or other jurisdictions. We may experience reluctance or refusal by current or prospective customers in these or other jurisdictions to use our products, and we and our customers may face a risk of regulatory enforcement actions or other proceedings relating to personal data transfers to us and by us from the EEA,