Company: QLYS
Filing Date: 2025-08-05
Form Type: 10-Q
Source: 0001107843-25-000031
Chunk: 300

Company: QUALYS, INC.
Filing Date: 2025-08-05
Form: 10-Q
Item: Part I, Item 2
Chunk 300
---
 relating to consumer data beginning on January 1, 2022, with enforcement authorized as of July 1, 2023. In addition, other states have enacted or proposed legislation that regulates the collection, use, and sale of personal information, including, for example, Washington's My Health, My Data Act and legislation similar to the CCPA adopted in Virginia, Colorado, Utah, Connecticut, Iowa, Indiana, Montana, Tennessee, Oregon, Florida, Delaware, Texas, Kentucky, New Jersey, New Hampshire, Maryland, Minnesota, Nebraska, and Rhode Island. Aspects of the CCPA, CPRA, and these other new and evolving state laws, as well their interpretation and enforcement, remain uncertain. The GDPR, CCPA, and other laws and regulations relating to privacy, data protection, and cybersecurity may be subject to new or changing interpretations by courts, and our interpretation of the law and efforts to comply with the rules and regulations of the law may be ruled invalid. We cannot predict the impact of the CCPA, CPRA, or other evolving privacy, data protection and cybersecurity obligations on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

The privacy, data protection, and cybersecurity laws and regulations we must comply with also are subject to change. For example, the United Kingdom has enacted a Data Protection Act, and has implemented legislation referred to as the "UK GDPR," which substantially implement the GDPR in the United Kingdom. This legislation provides for substantial penalties for noncompliance of up to the greater of £17.5 million or four percent of the previous year’s annual revenues. While the European Union has deemed the United Kingdom an "adequate country" to which personal data could be exported from the European Economic Area ("EEA"), this decision is required to be renewed in 2025 and may be modified, revoked, or challenged in the interim, creating uncertainty regarding transfers of personal data to the United Kingdom from the EEA, particularly in light of modifications to the Data Protection Act and UK GDPR in the Data (Use and Access) Bill, which received Royal Assent on June 19, 2025, and aims to modernize and streamline the UK's data protection framework. It remains unclear how United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the United Kingdom will be regulated. Additionally, we have self-certified under the EU-U.S. Data Privacy Framework, the