Company: PERI
Filing Date: 2025-03-25
Form Type: 20-F
Source: 0001178913-25-001021
Chunk: 55

Company: Perion Network Ltd.
Filing Date: 2025-03-25
Form: 20-F
Item: Item 3
Chunk 55
---
 in the case of the GDPR, the EEA and, in the case of PIPEDA and Quebec’s Law 25, Canada and Quebec, respectively. These laws contain significant penalties for non-compliance. Additionally, under the GDPR, supervisory authorities in the EU member states have some flexibility when implementing European Directives and certain aspects of the GDPR, which can lead to diverging national rules. In addition, following the withdrawal of the U.K. from the EU, we are subject to the U.K. GDPR. While the U.K. GDPR current imposes substantially the same obligations as the GDPR, the U.K. GDPR will not automatically incorporate changes to the GDPR going forward (which would need to be specifically incorporated by the U.K. government). Moreover, the U.K. government has publicly announced plans to reform the U.K. GDPR in ways that, if formalized, are likely to deviate from the GDPR, all of which exposes us to two parallel regimes (GDPR and U.K. GDPR), each of which authorizes similar fines and may subject us to increased compliance risk based on differing, and potentially inconsistent or conflicting, interpretation and enforcement by regulators and authorities (particularly, if the laws are amended in the future in divergent ways).
 
Additionally, some countries are considering or have enacted legislation requiring local storage and processing of data or otherwise restricting cross-border transfers of personal data that could increase the cost and complexity of delivering our services.  For example, as of September 22, 2023, Quebec’s Law 25 requires organizations to conduct a privacy impact assessment (“PIA”) in certain circumstances, such as when transferring personal data from Quebec to other jurisdictions (including to other provinces in Canada) as well as when acquiring, developing, or overhauling an information system or electronic service delivery system that involves the collection, use, release, keeping, or destruction of personal data. Such PIAs can be time consuming and costly and may impact our ability to attract/retain customers and service providers. Additionally, the GDPR and the U.K. GDPR generally prohibit the transfer of personal data from the EEA and the U.K. to the United States and most other countries, unless the transfer is to a country deemed to provide adequate protection (such as Israel, Canada or the U.K.) or the parties to the transfer have implemented specific safeguards to protect the transferred personal data. The GDPR and the U.K. GDPR requirements apply not only to third-party transactions, but also to transfers of information between us and our subsidiaries, including employee information