Company: ADPT
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030913
Chunk: 104

Company: Adaptive Biotechnologies Corp
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 104
---
, use or sharing, have more stringent requirements relating to organizations’ privacy programs and provide stronger individual rights. 

57

Moreover, international privacy and data security regulations are becoming more complex and may result in greater penalties. For instance, the GDPR governs the collection and use of personal data of data subjects in the EU and the EEA. The GDPR applies extra-territorially under certain circumstances and imposes stringent requirements on controllers and processors of personal data, including, for example, requirements to obtain consent or other legal bases from individuals to process their personal data, provide robust disclosures to individuals, accommodate a set of individual data rights, provide data security breach notifications after becoming aware of the breach, limit retention of personal information and apply enhanced protections to health data and other special categories of personal data. The GDPR also applies to pseudonymized data, which is defined as “the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information,” and imposes additional obligations when we contract with third-party processors in connection with the processing of any personal data. The GDPR provides that EU member states may make their own further laws and regulations limiting the processing of personal data, including genetic, biometric or health data, which could limit our ability to use and share personal data, could cause our costs to increase and could harm our financial condition. Compliance with the GDPR requires us to put in place and maintain additional policies, procedures and documentation as the law and updates to it require, which may result in other substantial expenditures. This may be onerous and adversely affect our business. Failure to comply with the GDPR and other countries’ privacy or data security-related laws, rules or regulations could result in material penalties imposed by regulators, affect our compliance with contracts entered into with our collaborators and other third-party payors, and have an adverse effect on our business and financial condition. 

In addition to the GDPR, we continue to expand our business into several countries that have or are developing data privacy laws. Compliance with such laws may be onerous and adversely impact expansion of our business.

Because of the breadth of these data protection laws and the narrowness of their exceptions and safe harbors, it is possible that our business or data protection policies could be subject to challenge under one or more of such laws. The scope and enforcement of each of these laws is uncertain and subject to rapid change in the current environment of heightened regulatory focus on data privacy and security issues. If our operations are found to be in violation of any