Company: PSEWF
Filing Date: 2025-03-04
Form Type: 20-F
Source: 0000950170-25-032340
Chunk: 90

Company: Paysafe Ltd
Filing Date: 2025-03-04
Form: 20-F
Item: Item 4
Chunk 90
---
 in negative impacts to our business. In the EU, we are also subject to enhanced compliance and operational requirements under the GDPR, which became effective in May 2018. The GDPR expands the scope of the EU data protection law to all foreign companies processing personal data of EU residents anywhere in the world and imposes a strict data protection compliance regime with severe penalties of up to the greater of 4% of worldwide turnover or €20 million, and includes rights such as the “portability” of personal data. Although the GDPR applies across the EU without a need for local implementing legislation, each EU member state has the ability to interpret the GDPR opening clauses, which permit country-specific data protection legislation and has created inconsistencies, on a country-by-country basis.
 
Since 2016, we have engaged in a large, transformative program regarding data privacy in connection with GDPR compliance requirements. However, policymakers around the globe are using these requirements as a reference to adopt new or updated privacy laws that could result in similar or stricter requirements in other jurisdictions. In the United States, the Gramm-Leach-Bliley Act of 1999 (along with its implementing regulations) restricts certain collection, processing, storage, use and disclosure of personal financial information, requires notice to individuals of privacy practices and provides individuals with certain rights to prevent the use and disclosure of certain nonpublic or otherwise legally protected information. These rules also impose requirements for the safeguarding and proper destruction of such information through the issuance of data security standards or guidelines. Within Canada, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) law is under consultation review in order to align more closely to GDPR and ensure continuation of its adequacy status from the European Commission and the provincial Quebec privacy law was amended in 2023 and requires further registration for biometric processing, with a new regulation governing data anonymity implemented in January 2025 .
 
In addition, there are now upwards of 20 USA States with privacy laws in place and many others with Bills in progress, including those restricting the ability to collect and use certain types of information such as Social Security and driver’s license numbers. Some impose stringent data privacy and data protection requirements, providing penalties for non-compliance (e.g. $7,500 per violation), including some States where the law provides for a private right of action in the event of a data breach. Increasingly, many states are now taking a GDPR approach and mandating data protection impact assessments, similar to the GDPR PIA / DPIA obligations and with some States progressing independent data protection