Company: AIP
Filing Date: 2025-08-05
Form Type: 10-Q
Source: 0001667011-25-000029
Chunk: 213

Company: Arteris, Inc.
Filing Date: 2025-08-05
Form: 10-Q
Item: Part II, Item 1A
Chunk 213
---
 protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the U.K. will be regulated in the long term. These changes will lead to additional costs and increase our overall risk exposure.

In addition, we are subject to evolving data privacy and security laws, rules and regulations in the PRC, particularly the Personal Information Protection Law (PIPL), Cybersecurity Law (CSL) and Data Security Law (DSL), along with their implementing regulations and standards. Consent from the data subject is required for any collection or processing of personal data, unless one of a limited number of exemptions applies. Notably, the PIPL, similar to the EU GDPR, applies extraterritorially in certain circumstances. 

The PIPL, CSL and DSL also specify rules for transferring personal information and the sui-generis category of ‘important data’ out of the PRC. Compliance with security assessments, obtaining certifications of group privacy standards by designated agencies, or entering into standard contracts (in approved form) with overseas recipients (to be filed with a PRC government agency) are among the requirements for transfer of personal data. All businesses in China additionally require government approval to transfer any amount of ‘important data’ generated within the PRC overseas. (‘Important data’ is a special category of data regulated under the DSL that has a national security, economic security or public interest dimension to it, but which has yet to be extensively classified, leading to significant uncertainty as to the scope of application of this rule at the present time.) Chinese law also imposes restrictions on the disclosure of data to foreign judicial and law enforcement bodies, and the extent and modalities of the application of this rule remain highly uncertain.

In addition to the CSL, the DSL and the PIPL, the relevant government authorities of the PRC have promulgated various regulations, draft regulations, guidelines and standards at both the national and provincial levels that are designed to provide further implemental guidance in accordance with the laws mentioned above. These laws and regulations continue to evolve, with an unpredictable impact on our operations in the PRC and related compliance costs. In addition, these laws and regulations are drafted broadly and thus leave significant discretion to the relevant PRC authorities, increasing the uncertainty about how they will be interpreted and enforced in practice.

Although we make reasonable efforts to comply with all applicable data protection laws and regulations, our interpretations and such measures have been or may prove to be insufficient or incorrect. The effects of any applicable state, federal and international laws and regulations that are currently