Company: NET
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001477333-25-000043
Chunk: 92

Company: Cloudflare, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 92
---
 significantly over time in a manner that can have a significantly adverse impact on both our business and our customers’ businesses.

50

This is especially true regarding the cross-border transfer of data. For example, in July 2023, the European Commission adopted an adequacy decision for the new EU-U.S. Data Privacy Framework, which generally allows the free flow of EU personal data to the United States for participating entities. While this framework currently serves as a means for cloud service providers like our company to freely transfer EU personal data to the United States, it may be subject to future legal challenges, suspension, amendment, repeal, or limitations to its scope by the European Commission, and some customers and vendors may be unwilling to rely on this framework due to these and other uncertainties. In addition, in January 2023, the European Data Protection Board issued its 2022 Coordinated Enforcement Action on the use of cloud-based services by the public sector, in which it expressed concerns that EU public sector entities may not be able to use U.S.-based cloud service providers consistently with GDPR due to their concerns about the ability of U.S. government agencies to access EU personal data. More recently, the European Data Protection Supervisor’s finding in March 2024 that the European Commission’s use of Microsoft 365 violates the GDPR in part due to EU personal data being transferred to countries that have not been determined by the EU to provide adequate level of protection suggests that EU regulators are continuing to subject data transfers outside the EU to careful scrutiny.

In addition, the United States has enacted the Protecting Americans' Data from Foreign Adversaries Act (PADFA), and the U.S. Department of Justice recently released a final rule implementing President Biden’s February 2024 Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern”, both of which restrict the transfer of certain types of data to named jurisdictions or covered entities. The shift to the new Trump administration, however, may result in uncertainty around the implementation of such regulations. We may incur substantial costs and an investment of resources to further understand the impact these new regulations will have on our and our customers’ business.

We also expect that there will continue to be new, and amendments to existing, laws, regulations, and industry standards concerning privacy, data protection, and information security proposed and enacted in the United States and various individual U.S. states. In the United States, various federal laws and regulations already apply to the collection, processing, disclosure