Company: CORT
Filing Date: 2025-07-31
Form Type: 10-Q
Source: 0001628280-25-037005
Chunk: 203

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-07-31
Form: 10-Q
Item: Part I, Item 4
Chunk 203
---
 European Commission adopted its adequacy decision on the E.U.-U.S. Data Privacy Framework (“DPF”). The decision, which took effect on the day of its adoption, concludes that the United States ensures an adequate level of protection for personal data transferred from the EEA to companies certified to the DPF. It is currently unclear how the future of DPF will evolve and what impact it will have on our international activities. The GDPR imposes substantial fines for breaches of data protection requirements, which can be up to four percent of global revenue for the preceding financial year or €20 million, whichever is greater, and it also confers a private right of action on data subjects for breaches of data protection requirements. Compliance with European data protection laws is a rigorous and time intensive process that may increase our cost of doing business, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm in connection with our European activities. From January 1, 2021, we have had to comply with the GDPR and separately the UK GDPR, which, together with the amended United Kingdom Data Protection Act 2018, retains the GDPR in United Kingdom national law, each regime having the ability to fine up to the greater of €20 million/£17.5 million or 4 percent of global turnover. It is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term and these changes may lead to additional costs and increase our overall risk exposure. Further, on June 28, 2021, the EC adopted an adequacy decision in favor of the United Kingdom, enabling data transfers from EU member states to the United Kingdom without additional safeguards. However, the United Kingdom adequacy decision will automatically expire in December 2025 unless the EC renews or extends that decision and remains under review by the Commission during this period.

Preparing for and complying with U.S. and foreign privacy and security laws and regulations is complex and costly as it is rigorous and time intensive and requires significant resources and a review of our technologies, systems and practices, as well as those of any third-party collaborators, service providers, CROs, contractors or consultants that process or transfer personal data collected in the EU. The GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as healthcare data or other personal data from our clinical trials, and access to certain data such as the European Health Data Space Regulation, could require us to change our business practices and put in