Company: RSKD
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001851112-25-000006
Chunk: 82

Company: RISKIFIED LTD.
Filing Date: 2025-03-06
Form: 20-F
Item: Item 4
Chunk 82
---
 and security, pricing, taxation, intellectual property ownership and infringement, anti-money laundering, anti-corruption, product liability, consumer protection, financing, payment authentication, artificial intelligence, machine learning, economic and financial sanctions, trade embargoes, and export control. Changes to such laws and regulations could cause us or third-party partners on which we rely to incur additional costs and change our or their respective business practices in order to comply. See “ - Data Protection and Privacy”, “ - Anti-Corruption and Sanctions” and “ - Artificial Intelligence” for further discussion related to the impact of government regulation on our business.

Data Protection and Privacy

We are subject to laws across several jurisdictions regarding privacy and protection of data. Laws and regulations related to data protection, privacy, cybersecurity, consumer protection, financing, payment authentication, point-of-sale lending, and other laws and regulations can be very stringent and vary from jurisdiction to jurisdiction. These laws govern how companies collect, process, and share data, grant rights to data subjects, and require that companies implement specific information security controls to protect certain types of information.

For example, we are subject to the PPL, and the more recent Data Security Regulations, which imposes obligations on how personal data is processed, maintained, transferred, disclosed, accessed and secured. The regulations may require us to adjust our data protection and data security practices, information security measures, certain organizational procedures, applicable positions (such as an information security manager) and other technical and organizational security measures. In addition, to the extent that any administrative supervision procedure is initiated by the Israeli Privacy Protection Authority that reveals certain irregularities with respect to our compliance with the Privacy Protection Act, in addition to our exposure to administrative fines, civil claims (including class actions) and in certain cases criminal liability, we may also need to take certain remedial actions to rectify such irregularities, which may increase our costs.

In the EEA and UK, we are also subject to the EU GDPR and the UK GDPR, as well as national legislation supplementing the GDPR and the UK GDPR. The GDPR implements stringent operational requirements regarding, among others, data use, sharing and processing, data breach notifications, data subject rights and cross- border data transfers. In relation to data transfers to the US, the EU-US Data Privacy Framework, the successor of the EU-US Privacy Shield entered into effect in July 2023, and the UK has enacted the UK extension to the EU-US Data Privacy Framework to facilitate EU-US and UK-US data transfers, respectively.

Further, following Brexit,