Company: RSKD
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001851112-25-000006
Chunk: 84

Company: RISKIFIED LTD.
Filing Date: 2025-03-06
Form: 20-F
Item: Item 4
Chunk 84
---
 impact of the DSA and DMA on our business or operations, but, to the extent applicable, it may require us to modify our practices and policies and we could incur substantial costs as a result.

We are also subject to Lei Geral de Proteção de Dados, which imposes similar requirements to the GDPR on the collection and processing of data of Brazilian residents.

We are also subject to the CCPA, which, among other things, gives California residents (which may include any of our current or future employees who may be California residents) rights over their Personal Information, including rights to opt out of certain Personal Information sharing/selling and requires in-scope business to provide California residents detailed information about how their Personal Information is used and disclosed. The CCPA provides for civil penalties for violations, as well as a private right of action certain for data breaches. Similar laws coming into effect in numerous other U. S. states, the potential for adoption of a comprehensive U. S. federal data privacy law, and new legislation in international jurisdictions may continue to change the data protection landscape globally and could result in us expending considerable resources to meet these requirements.

Additionally, in China, we are subject to the CSL, DSL, PIPL and other data-related regulations, such as the Cybersecurity Review Measures. The CSL requires certain network operators and service providers to, among other things, take necessary measures to safeguard the operation of networks and imposes certain additional requirements on CIIOs. The DSL provides for data security and privacy obligations on entities and individuals carrying out data processing activities, including but not limited to the collection, storage, use, processing, transmission, provision, and public disclosure of data. The DSL also requires data processors to establish and improve a whole-process data security management system, organize data security education and training, and take corresponding technical measures and other necessary measures to safeguard data security. The DSL requires a national security review procedure for those data activities which may affect national security and imposes export restrictions on certain data and information. Under the Cybersecurity Review Measures, a network platform operator who possesses personal data of more than one million users is required to apply for a cybersecurity review before listing in a foreign country, and the competent governmental authorities may initiate a cybersecurity review if they deem certain network products or services or data processing activities to affect national security. Network platform operators are not defined but are understood to be broadly interpreted to include all network platform operators or service providers, thus providing for a broad application. A mandatory cybersecurity review is likely to prolong the timeline of any contemplated listing abroad and