Company: INFY
Filing Date: 2025-07-01
Form Type: 20-F
Source: 0000950170-25-091925
Chunk: 30

Company: Infosys Ltd
Filing Date: 2025-07-01
Form: 20-F
Item: Item 3
Chunk 30
---
 If we or any of our third-party service providers suffer a cybersecurity breach or other data security incident, or if any such breach or incident is believed to have occurred, we have in the past and could in future face potential claims and litigation, regulatory investigations and inquiries, damages, fines, penalties, and other liability, substantial harm to our reputation, a loss of business, and significant costs to investigate, remediate, and otherwise address the breach or other incident. In addition, we have in the past and expect in the future to incur increased costs in preventing cybersecurity breaches or other information security incidents in the future. Furthermore, as there is increased focus on environmental, social and governance (“ESG”) concerns, our failure to demonstrate strong corporate governance around cybersecurity in the event of a breach could impact our reputation.
Our cybersecurity insurance covers first party losses that occur due to a cybersecurity-incident wherein losses include cost of forensics, appointing a crisis consultant and data restoration. The insurance also provides for business interruption losses that we might have to incur as a result of a system shutdown due to a cyber-incident. Our insurance may not be adequate to cover all losses in connection with any cybersecurity breach or other incident, and we cannot be certain that our present coverage, or any future coverage we may obtain, will remain available to us on commercially reasonable terms or at all.

Our reputation may be impacted, and we may incur financial liabilities if privacy breaches and incidents under General Data Protection Regulation (“GDPR”) or other data privacy regulations across the globe are attributed to us or if we are not able to take necessary steps to report such breaches and incidents to regulators and data subjects, wherever applicable, within the stipulated time or if we are unable to respond on data subject requests on timely manner. Further, any claim from our clients for losses suffered by them due to privacy breaches caused by our employees may impact us financially and affect our reputation.

The GDPR and similar data privacy laws in other jurisdictions impose additional obligations and increase risk exposure upon our business and increase substantially the penalties to which we could be subject to. For example, because the GDPR’s enforcement history on our industry sector is limited, we are unable to predict how certain obligations under the GDPR may be applied to us. Despite our efforts to comply with various data privacy laws applicable to us, a regulator may determine that what we have done is not sufficient and subject us to fines and public censure, which could harm our business and reputation.

We may see an increase in the number of data privacy incidents arising from our operations with