Company: LPSN
Filing Date: 2025-03-14
Form Type: 10-K
Source: 0001102993-25-000018
Chunk: 56

Company: LIVEPERSON INC
Filing Date: 2025-03-14
Form: 10-K
Item: Item 1A
Chunk 56
---
 EEA to the United States and which formed the basis of the new E.U.-US Data Privacy Framework (“DPF”), as released on December 13, 2022. The European Commission adopted its Adequacy Decision in relation to the DPF on July 10, 2023, rendering the DPF effective as an E.U. GDPR transfer mechanism to U.S. entities self-certified under the DPF. On October 12, 2023, the U.K. Extension to the DPF came into effect (as approved by the U.K. Government), as a U.K. GDPR data transfer mechanism to U.S. entities self-certified under the U.K. Extension to the DPF. We currently rely on the DPF and on a similar Swiss-US Data Privacy Framework to transfer certain personal data from the EEA and Switzerland, respectively to the United States and on the U.K. Extension to the DPF to transfer certain personal data from the U.K. to the United States. In recent years, the UK government has introduced proposed legislation intended to create a more business-friendly regime in the UK through changes to the existing data protection legislation. At this stage it is unclear whether and when changes to the legislation will be adopted and whether such legislative reforms could potentially lead the European Commission not to extend or to revoke the UK adequacy decision. We also currently rely on the E.U. standard contractual clauses and the U.K. Addendum to the E.U. standard contractual clauses and the U.K. International Data Transfer Agreement as relevant to transfer personal data outside the EEA and the U.K. with respect to both intragroup and third-party transfers. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators.

If the transfer mechanisms we rely on are not sufficient and we are unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services and could adversely affect our financial results, and, until the legal uncertainties regarding how to legally continue transfers pursuant to the standard contractual clauses and other mechanisms are settled, we will continue to face uncertainty as to whether our efforts to comply 

24

with our obligations under the GDPR and U.K. GDPR will be sufficient. Failure to comply with existing or new rules may result in significant penalties or orders to stop