Company: CALX
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001406666-25-000045
Chunk: 156

Company: CALIX, INC
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 2
Chunk 156
---
5, the DSP imposes stringent obligations on companies within its scope and prohibits or restricts “covered data transactions” that grant countries of concern or covered persons access to bulk U.S. sensitive personal data or any amount of government-related data. The DSP is new, complex and has yet to be enforced, and as such, there is a risk that our interpretation of its applicability, scope and requirements is incorrect, incomplete or misapplied.

Compliance with the DSP may require us to invest heavily in data security and compliance measures, such as implementing and complying with the Cybersecurity and Infrastructure Security Agency’s guidelines and other burdensome recordkeeping, reporting and auditing requirements. It may also require us to implement new processes, stop or restrict certain data transfers, alter the geographic scope of our operations, cease doing business with certain third parties or using certain tools or vendors, or change how data flows throughout our business, any of which could materially impact our business operations or hinder our ability to grow our business. Finally, non-compliance with the DSP could result in significant civil or criminal penalties, which could materially adversely affect our business, results of operations and financial condition.

41

Table of Contents

Furthermore, the Federal Trade Commission, or FTC, and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers’ personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.

The General Data Protection Regulation, or EU GDPR, adopted by the European Union, or EU, and the UK General Data Protection Regulation, or UK GDPR, adopted by the United Kingdom, or UK, (the EU GDPR and UK GDPR hereinafter referred to as the GDPR) and national data protection supplementing laws in these jurisdictions impose specific duties and requirements upon companies that are subject to their provisions and collect, process or control personal data of individuals. Although we currently do not have material operations or business in the EU or the UK, we are in the process of expanding in these jurisdictions, and we have incurred and will continue to incur substantial costs in this respect. Furthermore, the GDPR