Company: BL
Filing Date: 2025-05-07
Form Type: 10-Q
Source: 0001666134-25-000016
Chunk: 124

Company: BLACKLINE, INC.
Filing Date: 2025-05-07
Form: 10-Q
Item: Part II, Item 1A
Chunk 124
---
 employees, certain rights similar to those provided by the GDPR, and also provides for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation. Numerous other states have also enacted or are in the process of enacting or considering state-level data privacy and security laws, rules and regulations. Furthermore, the U.S. Congress is considering privacy legislation, and the U.S. Federal Trade Commission continues to use its enforcement authority under Section 5 of the FTC Act against companies for privacy and cybersecurity practices alleged to be unfair or deceptive.

Globally, virtually every jurisdiction in which we operate has established its own frameworks governing privacy, data protection, and cybersecurity with which we, and/or our customers, must comply. These laws and regulations often are more restrictive than those in the U.S. Regulatory developments in these countries may require us to modify our policies, procedures, and data processing measures in order to address requirements under these or other applicable privacy, data protection, or cybersecurity regimes, and we may face claims, litigation, investigations, or other proceedings regarding them, initiated by private parties and governmental authorities, and may incur related liabilities, expenses, costs, and operational losses. Our compliance efforts are further complicated by the fact that laws and regulations relating to privacy, data protection, and cybersecurity around the world are rapidly evolving, may be subject to uncertain or inconsistent interpretations and enforcement, and may conflict among various jurisdictions.

In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that may place additional burdens on us. Our customers may require us, or we may find it advisable, to meet voluntary certifications or adhere to other standards established by them or third parties, such as the SSAE 18, SOC1, and SOC2 audit processes. If we are unable to maintain such certifications, comply with such standards, or meet such customer requests, it could reduce demand for our services and adversely affect our business.

Compliance with applicable laws and regulations relating to privacy, data protection, and cybersecurity may require changes in our services, business practices, or internal systems that result in increased costs, lower revenue, reduced efficiency, or negative effects on our ability to attract and retain customers in certain industries and foreign countries, which could adversely affect our business. The costs of compliance with, and other obligations imposed by, these laws and regulations may require modification of our services, limit use and adoption of our services, reduce overall demand for our services, lead to significant fines,