Company: SCYX
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000950170-25-038044
Chunk: 41

Company: SCYNEXIS INC
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1
Chunk 41
---
 Act, the California Consumer Privacy Act of 2018 (CCPA), the Canadian Personal Information Protection and Electronic Documents Act, Canada’s Anti-Spam Legislation, the European Union’s General Data Protection Regulation 2016/679 (EU GDPR), the EU GDPR as it forms part of United 

15

Kingdom (UK) law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (UK GDPR), and the Payment Card Industry Data Security Standard (PCI DSS).  Several states within the United States have enacted or proposed data privacy and security laws.  For example, Virginia passed the Consumer Data Protection Act, and Colorado passed the Colorado Privacy Act.  Additionally, we are, or may become, subject to various U.S. federal and state consumer protection laws which require us to publish statements that accurately and fairly describe how we handle personal data and choices individuals may have about the way we handle their personal data.

The CCPA and EU GDPR are examples of the increasingly stringent and evolving regulatory frameworks related to personal data processing that may increase our compliance obligations and exposure for any noncompliance.  For example, the CCPA imposes obligations on covered businesses to provide specific disclosures related to a business’s collection, use, and disclosure of personal data and to respond to certain requests from California residents related to their personal data (for example, requests to know of the business’s personal data processing activities, to delete the individual’s personal data, and to opt out of certain personal data disclosures).  Also, the CCPA provides for civil penalties and a private right of action for data breaches which may include an award of statutory damages.  In addition, the California Privacy Rights Act of 2020 (CPRA), effective January 1, 2023, expanded the CCPA by, among other things, giving California residents the ability to limit use of certain sensitive personal data, establishing restrictions on personal data retention, expanding the types of data breaches that are subject to the CCPA’s private right of action, and establishing a new California Privacy Protection Agency to implement and enforce the new law.

Foreign data privacy and security laws (including but not limited to the EU GDPR and UK GDPR) impose significant and complex compliance obligations on entities that are subject to those laws.  As one example, the EU GDPR applies to any company established in the EEA and to companies established outside the EEA that process personal data in connection with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data