Company: CORT
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001628280-25-048841
Chunk: 90

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-11-04
Form: 10-Q
Item: Part I, Item 8
Chunk 90
---
 were required to be retired by December 27, 2022. As supervisory authorities issue further guidance on personal data export mechanisms, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. Further, on July 10, 2023, the European Commission adopted its adequacy decision on the E.U.-U.S. Data Privacy Framework (“DPF”). The decision, which took effect on the day of its adoption, concludes that the United States ensures an adequate level of protection for personal data transferred from the EEA to companies certified to the DPF. It is currently unclear how the future of DPF will evolve and what impact it will have on our international activities. The GDPR imposes substantial fines for breaches of data protection requirements, which can be up to four percent of global revenue for the preceding financial year or €20 million, whichever is greater, and it also confers a private right of action on data subjects for breaches of data protection requirements. Compliance with European data protection laws is a rigorous and time intensive process that may increase our cost of doing business, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm in connection with our European activities. From January 1, 2021, we have had to comply with the GDPR and separately the UK GDPR, which, together with the amended United Kingdom Data Protection Act 2018, retains the GDPR in United Kingdom national law, each regime having the ability to fine up to the greater of €20 million/£17.5 million or 4 percent of global turnover. It is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term and these changes may lead to additional costs and increase our overall risk exposure. In addition, on June 19, 2025, the United Kingdom’s Data (Use and Access) Act 2025 (the “DUAA”) was granted Royal Assent, implementing various measures concerning data usage in the UK and reforming data protection laws. The provisions within the DUAA will come into force through 2026, and it is currently unclear how the DUAA will be implemented and what impact it will have on our international activities.

Preparing for