Company: DOMO
Filing Date: 2025-04-04
Form Type: 10-K
Source: 0001505952-25-000045
Chunk: 75

Company: DOMO, INC.
Filing Date: 2025-04-04
Form: 10-K
Item: Item 1A
Chunk 75
---
 stringent operational requirements for processors and controllers of personal data and imposes significant penalties for noncompliance of up to the greater of €20 million or 4% of global annual revenues. Complying with the GDPR, the CCPA, and other laws and regulations governing privacy, data protection, and cybersecurity may cause us to incur substantial operational costs or require us to modify our data handling practices. Actual or alleged noncompliance could result in proceedings against us by governmental entities or others (including a private right of action for affected individuals in certain instances) and substantial penalties, fines, and other liabilities, and may otherwise adversely impact our business, financial condition, and operating results.

Further, the United Kingdom has enacted a Data Protection Act and a version of the GDPR referred to as the UK GDPR that, collectively, substantially implement the GDPR in the United Kingdom and provide for penalties of up to the greater of £17.5 million and 4% of total annual revenue. Uncertainty remains, however, regarding aspects of data protection in the United Kingdom in the medium to long term, and the United Kingdom is contemplating new data protection legislation. On June 28, 2021, the European Commission announced a decision of “adequacy” concluding that the United Kingdom ensures an equivalent level of data protection to the GDPR, which provides some relief regarding the legality of continued personal data flows from the European Economic Area to the United Kingdom. This adequacy determination must be renewed after four years, however, and may be modified or revoked in the interim. Further, United Kingdom data protection law imposes restrictions on personal data transfers to the U.S., similar to those imposed by the GDPR, and the United Kingdom’s Information Commissioner’s Office issued new standard contractual clauses, effective March 21, 2022, that are required to be implemented.

We previously were certified under the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield with respect to our transfer of certain personal data from the E.U. and Switzerland to the United States. The E.U.-U.S. Privacy Shield framework and the use of E.U. Standard Contractual Clauses (the SCCs) to protect data exports between the E.U. and the U.S. have been subject to legal challenges in the E.U, and on July 16, 2020, the Court of Justice of the European Union (the CJEU), Europe's highest court, held in the “Schrems II” case that the E.U.-U.S. Privacy Shield was invalid, and