Company: VEEV
Filing Date: 2025-11-21
Form Type: 10-Q
Source: 0001393052-25-000078
Chunk: 63

Company: VEEVA SYSTEMS INC
Filing Date: 2025-11-21
Form: 10-Q
Item: Part I, Item 4
Chunk 63
---
. Furthermore, we have in the past and may in the future be subject to inspections or audits by government agencies or other regulatory bodies to verify our customers’ compliance with applicable laws, regulations, or GxP principles. 

Additionally, any failure of our customers to comply with laws and regulations applicable to the functions for which they use our solutions could result in investigations by regulatory authorities, fines, penalties, or claims for substantial damages against our customers that may, in turn, harm our business or reputation. If such failure were allegedly caused by our solutions or services, our customers may make a claim for damages against us, regardless of our responsibility for the failure. We may be subject to investigations and lawsuits that, even if unsuccessful, could divert our resources and our management’s attention and adversely affect our business and customer relationships, and our insurance coverage may not be sufficient to cover such claims against us.

Increasingly complex regulations relating to privacy, data protection, and cybersecurity are burdensome, may reduce demand for our solutions, and non-compliance may impose significant liabilities.

Our customers use our solutions to collect, use, store, disclose, and otherwise process personal data regarding their employees, healthcare professionals, and patients. Patient data may include sensitive health data. In many countries, governmental bodies have adopted or may adopt laws and regulations regarding the security, collection, use, storage, disclosure, and other processing of personal data, making compliance an increasingly complex task.

Under the European General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s General Data Protection Regulation (“UK GDPR”), as amended by the Data (Use and Access) Act 2025, we act as a data controller for our data products and a data processor with respect to our software products. Each of the GDPR and UK GDPR impose significant data protection obligations and provide for substantial penalties and other remedies for noncompliance. We maintain active self-certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. We also rely on EU, Swiss, and UK Standard Contractual Clauses, as well as our technical, contractual, and security measures, to help ensure that our European customers have the appropriate legal mechanisms in place for their personal data to be accessed from within the United States. We are required to take steps to legitimize any personal data transfers impacted by these developments and similar developments in other jurisdictions, and to engage in contract negotiations with third parties that aid