Company: JBI
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001839839-25-000032
Chunk: 58

Company: Janus International Group, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 58
---
 personal data continue to evolve. The GDPR imposes, among other things, strict obligations and restrictions on the collection and use of U.K. and E.U. personal data, a requirement for prompt notice of data breaches in certain circumstances, a requirement for implementation of certain approved safeguards (such as the use of approved “standard contractual clauses” and the performance of appropriate data transfer impact assessments, as applicable) for transfers of personal data to other countries that have not been determined by the E.U. or the U.K. to provide adequate data privacy protections, and possible substantial fines for any violations. Numerous other countries, including those in which we operate, have introduced and, in some cases, enacted, similar data privacy and cyber and data security laws.

The interpretation and enforcement of the laws and regulations described above are uncertain and subject to change and may require substantial costs to monitor and implement compliance with any additional requirements. Failure to comply with U.S. and international data protection laws and regulations could result in government enforcement actions (which could include substantial civil and/or criminal penalties), private litigation and/or adverse publicity, and could negatively affect our operating results and business.

Privacy concerns could result in regulatory changes that may harm our business.

Personal privacy has become a significant issue in the jurisdictions in which we operate. Many jurisdictions in which we operate, including California, Canada, and certain E.U. member states, have imposed restrictions and requirements on the use of personal information by those collecting such information. The regulatory framework for privacy issues is rapidly evolving and future enactment of more restrictive laws, rules, or regulations and/or future enforcement actions or investigations could have a materially adverse impact on us through increased costs or restrictions on our business or our customers businesses. Failure to comply with such laws and regulations could result in consent orders or regulatory penalties and significant legal liability, including fines, which could damage our reputation and have an adverse effect on our results of operations or financial condition.

We must comply with increasingly complex and rigorous regulatory standards enacted to protect businesses and personal data, including the GDPR and the California Consumer Privacy Act (“CCPA”). The E.U. GDPR is a comprehensive E.U. privacy and data protection reform, effective in 2018, which applies to companies that are organized in the EU or otherwise provide services to consumers who reside in the E.U., and imposes strict standards regarding the sharing, storage, use, disclosure, and protection of end user data and significant penalties (monetary and otherwise) for non-compliance. The CCPA, effective in 2020, together with the California Privacy Rights