Company: PAYC
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000950170-25-024136
Chunk: 53

Company: Paycom Software, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 53
---
 jurisdictions, such as Canada’s PIPEDA and Mexico’s Federal Law on the Protection of Personal Data held by Private Parties, as well as the GDPR, which is applicable in the European Economic Area and the United Kingdom.

Many of these newer state-level consumer privacy laws give consumers located in those states certain rights to be informed of, opt-out of, and request deletion of the personal information that we hold, similar to those rights provided by the European Union’s GDPR. Notably, the GLBA is enforced under the authority of the Federal Trade Commission and requires our payment card services to adhere to a privacy notice and take certain measures to protect related personal information from unauthorized use and threats to data security. The FCRA places certain requirements and duties on our business as a furnisher of information to certain consumer reporting agencies with which we share limited amounts of data. Because some of our clients are located in Mexico and other clients have establishments internationally, Canada’s PIPEDA, Mexico’s Federal Law on the Protection of Personal Data, and other foreign data privacy laws, such as the GDPR, may impact our processing of certain client and employee information. Failure to comply with data protection and privacy laws and regulations could result in regulatory scrutiny and increased exposure to the risk of litigation or the imposition of consent orders, injunctions against data processing or data exporting, or civil and criminal penalties, including fines, which could have an adverse effect on our results of operations or financial condition. Moreover, allegations of non-compliance with privacy laws, whether or not true, could be costly, time consuming, distracting to management, and cause reputational harm. The landscape of privacy laws applicable to our various products and services is evolving quickly. The CPRA, which expands upon the CCPA, went into effect in 2023. Fourteen other states have now enacted their own consumer data privacy statutes, many of which are modeled on the CCPA. New data privacy statutes are slated to go into effect later this year in Delaware, Iowa, Nebraska, New Hampshire, and New Jersey. In addition, there are a number of other legislative proposals worldwide for comprehensive privacy laws affecting consumer and employee personal information, which could impose additional and potentially conflicting obligations in areas affecting our business. Newly-passed legislative and regulatory initiatives may adversely affect the ability of our clients to process, handle, store, use and transmit demographic and personal information from their employees, which could reduce demand for our services.

In addition to government regulation, privacy advocates and industry groups may propose and adopt new and different self-regulatory standards. Because the