Company: TXG
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001770787-25-000013
Chunk: 98

Company: 10x Genomics, Inc.
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1A
Chunk 98
---
 holder or to make generally available, in source code form, our proprietary code, any of which could adversely affect our business, operating results and financial condition.

We collect, process, store, share, disclose and use personal information and other data, which subjects us to governmental regulations and other legal obligations related to privacy and security, and our actual or perceived failure to comply with such obligations could harm our business.

We collect, process, store, transmit, disclose and use information from our employees, customers and others, including personal information and other data, some of which may be sensitive in nature. There are numerous federal, state and foreign laws and regulations regarding data protection, privacy and security. We strive to comply with applicable laws, our posted policies and legal contractual obligations relating to privacy and data protection. However, the scope of these laws is changing, is subject to differing interpretations, may be costly to comply with and may be inconsistent among countries and jurisdictions or conflict with other rules. Our business, including our ability to operate and expand internationally, could be adversely affected if legislation or regulations are adopted, interpreted or implemented in a manner that is inconsistent with our current business practices and that require changes to these practices.

The global data protection landscape is rapidly evolving and new laws and regulations are constantly being enacted such as China's "Personal Information Protection Law" and Singapore's "Personal Data Protection Act." Violations of existing and new laws and regulations may subject companies to significant penalties and fines, government investigations and/or enforcement actions, private litigation and other claims. Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. For example, in Europe, the GDPR went into effect in May 2018 and imposes stringent requirements for processing personal data of individuals within the European Economic Area ("EEA"). The processing of sensitive personal data, 

47

such as physical health conditions, may impose heightened compliance burdens under the GDPR and is a topic of active interest among foreign regulators. In addition, the GDPR provides for breach reporting requirements, more robust regulatory enforcement and greater penalties for noncompliance than previous data protection laws, including fines of up to €20 million or 4% of a noncompliant company’s global annual revenue for the preceding financial year, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries outside the EEA that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA and the United States