Company: TXG
Filing Date: 2025-05-09
Form Type: 10-Q
Source: 0001770787-25-000032
Chunk: 127

Company: 10x Genomics, Inc.
Filing Date: 2025-05-09
Form: 10-Q
Item: Part I, Item 8
Chunk 127
---
 to differing interpretations, may be costly to comply with and may be inconsistent among countries and jurisdictions or conflict with other rules. Our business, including our ability to operate and expand internationally, could be adversely affected if legislation or regulations are adopted, interpreted or implemented in a manner that is inconsistent with our current business practices and that require changes to these practices.

The global data protection landscape is rapidly evolving and new laws and regulations are constantly being enacted such as China's "Personal Information Protection Law" and Singapore's "Personal Data Protection Act." Violations of existing and new laws and regulations may subject companies to significant penalties and fines, government investigations and/or enforcement actions, private litigation and other claims. Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. For example, in Europe, the GDPR went into effect in May 2018 and imposes stringent requirements for processing personal data of individuals within the European Economic Area ("EEA"). The processing of sensitive personal data, such as physical health conditions, may impose heightened compliance burdens under the GDPR and is a topic of active interest among foreign regulators. In addition, the GDPR provides for breach reporting requirements, more robust regulatory enforcement and greater penalties for noncompliance than previous data protection laws, including fines of up to €20 million or 4% of a noncompliant company’s global annual revenue for the preceding financial year, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries outside the EEA that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA and the United States remains uncertain. Case law from, the Court of Justice of the EU (“CJEU”) states that reliance on the standard contractual clauses, or SCCs - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On July 10, 2023, the European Commission adopted its Adequacy Decision in relation to the new EU-US Data Privacy Framework (“DPF”), rendering the DPF effective as a GDPR transfer mechanism to U.S. entities self-certified under the DPF. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or start taking enforcement action, we