Company: DOMO
Filing Date: 2025-04-04
Form Type: 10-K
Source: 0001505952-25-000045
Chunk: 74

Company: DOMO, INC.
Filing Date: 2025-04-04
Form: 10-K
Item: Item 1A
Chunk 74
---
 certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and became effective January 1, 2023. The CPRA amended and expanded the CCPA in numerous respects, including by expanding the CCPA’s private right of action. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that has become effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that became effective in 2024, Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee have adopted such legislation that will become effective in 2025, and Indiana, Kentucky, and Rhode Island have adopted such legislation that will become effective in 2026. Broad federal privacy legislation has also been proposed. Additionally, states have adopted other laws and regulations relating to privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action. These and other new and evolving laws and regulations relating to privacy in the U.S. could increase our potential liability and adversely affect our business. Aspects of these laws and regulations and their interpretation and enforcement remain uncertain. We cannot fully predict the impact of these or other new and evolving laws and regulations relating to privacy and cybersecurity on our business or operations, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply.

In addition, several foreign countries and governmental bodies, including the E.U., as well as the United Kingdom, Australia, Brazil, India, and Japan, where we maintain offices or other operational presences, have laws and regulations 

43

dealing with the handling and processing of personal data obtained from their residents, which in certain cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, security, disclosure, and other processing of various types of data, including data that identifies or may be used to identify an individual. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Within the E.U., in May 2018, a far-reaching regulation governing data and privacy practices called the General Data Protection Regulation (GDPR) became effective. The GDPR includes