Company: RPID
Filing Date: 2025-08-12
Form Type: 10-Q
Source: 0001380106-25-000174
Chunk: 166

Company: RAPID MICRO BIOSYSTEMS, INC.
Filing Date: 2025-08-12
Form: 10-Q
Item: Part I, Item 4
Chunk 166
---
 may require us to expend significant resources in connection with our compliance efforts and subject us to enforcement actions or otherwise incur liability for any actual or perceived noncompliance, including litigation, enforcement actions and reputational harm leading to a loss of existing and future business.

Internationally, laws, regulations and standards in many jurisdictions apply broadly to the collection, use, retention, security, disclosure, transfer and other processing of personal information. For example, with respect to the collection and processing of personal data relating to our personnel, customers and establishments in Europe, we are subject to the EU General Data Protection Regulation, or EU GDPR, the UK General Data Protection Regulation (UK GDPR), as well as applicable data protection laws in effect in the Member States of the EEA and in the UK (including the UK Data Protection Act 2018) which govern the processing of personal data in connection with (a) our offering of goods or services to/the monitoring of the behavior of individuals in the UK and EEA; or (b) the activities of any of our establishments in the UK or any EEA Member State, such as our German subsidiary. In this Quarterly Report on Form 10-Q, references to “GDPR” encompass both the EU GDPR and UK GDPR, unless specific otherwise. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including  requiring disclosures to individuals regarding data processing activities, requiring that safeguards are implemented to protect the security and confidentiality of personal data, limiting retention periods for personal data, creating mandatory data breach notification requirements in certain circumstances, and requiring that certain measures (including contractual requirements) are put in place when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside the EEA or the U.K., including transfers of personal data from Europe to the United States in certain circumstances. Any inability to transfer personal data from Europe to the United States in compliance with data protection laws may impede our operations and may adversely affect our business and financial position. Switzerland has also 

59

implemented data protection laws with similar obligations and triggers to the GDPR which we may be subject to in connection with our Swiss subsidiary, personnel and customers.

The complex and evolving nature of data protection laws and regulations may lead to additional compliance costs, including as a result of diverging international data privacy laws and regulations and related uncertainties. There can be no assurances that we will be successful in our efforts to comply with the multitude of U.S., state, federal, and foreign privacy and data security laws, and