Company: BOLT
Filing Date: 2025-03-24
Form Type: 10-K
Source: 0000950170-25-043873
Chunk: 86

Company: Bolt Biotherapeutics, Inc.
Filing Date: 2025-03-24
Form: 10-K
Item: Item 1A
Chunk 86
---
,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA increases compliance costs and potential liability with respect to other personal data we maintain about California residents. In addition, the California Privacy Rights Act of 2020 (“CPRA”) expands the CCPA’s requirements, including by adding a new right for individuals to correct their personal information and establishing a new regulatory agency to implement and enforce the law.

Other states, such as Virginia, Colorado, Utah, and Connecticut have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely.

Outside the United States, an increasing number of laws, regulations, and industry standards may govern data privacy and security.  For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), and the Personal Information Protection Act ("PIPA"), in South Korea, impose strict requirements for processing personal data.  Under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros or 4% of annual global revenue, whichever 

47

is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries.  Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the United Kingdom (UK) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate.  Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws.  Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to law