Company: NCNO
Filing Date: 2025-04-01
Form Type: 10-K
Source: 0001902733-25-000026
Chunk: 86

Company: nCino, Inc.
Filing Date: 2025-04-01
Form: 10-K
Item: Item 1A
Chunk 86
---
 appropriate technical and organizational security measures to safeguard personal data; and (vi) obligations to report certain personal data breaches to the relevant supervisory authority without undue delay (and no later than 72 hours where feasible) and affected individuals, where the personal data breach is likely to result in a high risk to their rights and freedoms. Processors are required to notify the controller without undue delay after becoming aware of a personal data breach.

In addition, the EU GDPR prohibits the international transfer of personal data from the EEA to countries outside of the EEA unless made to a country deemed to have adequate data privacy laws by the European Commission or a data transfer mechanism in accordance with the EU GDPR has been put in place (e.g., Standard Contractual Clauses or “SCCs”) or a derogation under the EU GDPR can be relied on. In certain cases (e.g. where transfers are made in reliance on SCCs) it is also necessary to carry out a transfer impact assessment ("TIA") which, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under SCCs will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA. On July 10, 2023, the European Commission adopted its Final Implementing Decision granting the U.S. adequacy (“Adequacy Decision”) for EU-US transfers of personal data for entities self-certified to the EU-US Data Privacy Framework (“DPF”). Entities relying on EU SCCs for transfers to the U.S. are also able to rely on the analysis in the Adequacy Decision as support for their TIA regarding the equivalence of U.S. national security safeguards and redress.

The UK GDPR also imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK government does not consider adequate. The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the new SCCs. The UK Information Commissioner's Office ("ICO") has also published its own version of the TIA, although entities may choose to adopt either the EU or UK-style TIA. Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-U.S. data bridge (i.e., a UK equivalent of the Adequacy Decision) and adopted UK regulations to implement the UK-U.S. data