Company: NET
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001477333-25-000141
Chunk: 510

Company: Cloudflare, Inc.
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 8
Chunk 510
---
 a result of these developments or otherwise, we may continue to see more findings from regulators around the world against cloud service providers relating to cross-border personal data transfers, and may find it necessary or appropriate to modify our policies and practices to address any such findings or other legislative developments relating to cross-border personal data transfers. Implementing any new guidance from applicable regulatory authorities and otherwise responding to or addressing developments relating to cross-border personal data transfers may result in substantial costs, require changes to our policies and business practices, require us to engage in additional contractual negotiations, limit our ability to provide certain products in certain jurisdictions, limit our ability to provide certain products to certain customers, or materially adversely affect our business and operating results.

86

We also expect that there will continue to be new, and amendments to existing, laws, regulations, and industry standards concerning privacy, data protection, and information security proposed and enacted in the United States and various individual U.S. states. In the United States, various federal laws and regulations apply to the collection, processing, disclosure and security of certain types of data, including the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act of 1996, and the Gramm-Leach-Bliley Act. In addition, there are also a number of recently enacted or proposed U.S. federal and state privacy and data protection bills in Congress and state legislatures across the country.

Obligations relating to privacy, data protection, and information security also are increasing in complexity outside the U.S. For example, the EU has revised its Cybersecurity Directive (NIS2), which, among other things, obligates companies to adopt or update policies and procedures on issues such as incident handling and supply chain security, implementing certain administrative measures, and requires top management’s involvement in cybersecurity risk-management measures, with top management potentially held liable for non-compliance. NIS2 provides for significant penalties for noncompliance, requiring EU member states to provide for a maximum fine level of at least €10,000,000 or 2% of annual turnover, whichever is greater. In addition, the EU’s Digital Operational Resiliency Act became effective in January 2025. This law aims to establish a universal framework for managing and mitigating information and communication technology risk that will apply to entities in the financial sector and their third-party cloud service providers.

Laws and regulations regarding the development, use, and deployment of AI technologies in the EU, U.S., and elsewhere are increasing in complexity. For