Company: RSKD
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001851112-25-000006
Chunk: 33

Company: RISKIFIED LTD.
Filing Date: 2025-03-06
Form: 20-F
Item: Item 3
Chunk 33
---
 the Israeli Privacy Protection Authority (“ PPA”), (together the “ PPL”), which impose obligations with respect to the manner Personal Information is processed, maintained, transferred, disclosed, accessed, and secured. In this respect, the Data Security Regulations may require us to adjust our data protection and data security practices, information security measures, certain organizational procedures, applicable positions (such as an information security manager) and other technical and organizational security measures.

In this context, material amendments to the PPL were approved by the Israeli Parliament in August 2024 and will take effect on August 14, 2025 (“ Amendment 13”). Among other things, Amendment 13 expands the PPA’s authority to investigate incidents where there is concern of privacy violation and to impose monetary sanctions that are considerably higher than those currently available under the PPL and its regulations. Additionally, Amendment 13 introduces new obligations for parties processing Personal Information, which may require us to modify our data practices and policies, appoint mandatory positions, and consequently, to incur substantial costs to align our privacy and data protection practices in Israel.

Moreover, in January 2025, the Privacy Protection Regulations (Provisions Regarding Information Transferred to Israel from the European Economic Area), 2023 (“ EU Regulations”) came into effect, also with respect to Personal Information related to Israeli individuals. As a result, we may need to adjust our practices, particularly those concerning data subjects’ rights.

Failure to comply with the PPL may expose us to administrative fines, civil claims (including class actions) and in certain cases criminal liability. Upon Amendment 13 taking effect in August 2025, the sanctions for non-compliance with the PPL and its regulations (including the Data Security Regulations and the EU Regulations) will be significantly increased and, in certain cases, may reach substantial amounts in the millions of NIS. In addition, we may also need to take certain remedial actions to rectify such irregularities, which may increase our costs.

While it is generally the laws of the jurisdiction in which a business is located that apply, there is a risk that data protection regulators of other countries may seek jurisdiction over our remote activities in locations in which we process data or serve merchants or shoppers but do not have an operating entity. Where the local data protection and privacy laws of a jurisdiction apply, we may be required to register our operations in that jurisdiction or make changes to our business so that shopper data is only collected and processed in accordance with applicable local law. In addition, because our services are accessible worldwide, certain foreign