Company: IOT
Filing Date: 2025-03-25
Form Type: 10-K
Source: 0001642896-25-000022
Chunk: 73

Company: Samsara Inc.
Filing Date: 2025-03-25
Form: 10-K
Item: Item 1A
Chunk 73
---
 to the GDPR to “third countries” that have not been found to provide adequate protection to such personal data, including the United States, Mexico, Colombia, Taiwan, and India. We have undertaken certain efforts to conform transfers of personal data subject to the GDPR from the European Economic Area (“EEA”) to the United States and other relevant jurisdictions based on our understanding of current regulatory obligations and the guidance of data protection authorities, including the use of SCCs approved by the European Commission; however, international data transfers may still be challenged in countries that have not received “adequacy” status from the European Commission. For example, in the Schrems II decision issued by the Court of Justice of the European Union (“CJEU”) on July 16, 2020, the CJEU, among other things, imposed additional obligations on companies when relying on the SCCs. EEA regulators since have provided guidance regarding use of the SCCs, and on June 4, 2021, the European Commission issued new SCCs that are required to be implemented where appropriate. The European Commission subsequently adopted an adequacy decision that also covers transfers of personal data to the United States under an alternative mechanism called the EU-U.S. Data Privacy Framework. The EU-U.S. Data Privacy Framework is the successor to the EU-U.S. Privacy Shield and allows participating entities to transfer personal data to the United States. As we continued to participate in Privacy Shield, we transitioned automatically to the EU-U.S. Data Privacy Framework, as well as a UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, which are designed to allow personal data transfers from the United Kingdom and Switzerland, respectively, to the United States. The Swiss-U.S. Data Privacy Framework was granted an adequacy decision from Switzerland’s Federal Data Protection and Information Commissioner that became effective on September 15, 2024. There is no guarantee that any of these frameworks will survive any legal challenges and therefore, in light of this uncertainty, we will need to continue monitoring and taking appropriate steps to mitigate the impact on us with respect to the transfers of relevant personal data outside of the EEA, United Kingdom, and Switzerland. The United Kingdom has enacted the UK Data Protection Act (“UK DPA”) and UK GDPR, which substantially implement the GDPR and provide for substantial penalties in a manner similar to the GDPR (up to the greater of £17.5 million and 4% of global annual turnover for the preceding financial year for the most serious violations