Company: QLYS
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001107843-25-000038
Chunk: 258

Company: QUALYS, INC.
Filing Date: 2025-11-04
Form: 10-Q
Item: Part I, Item 8
Chunk 258
---
 our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

The privacy, data protection, and cybersecurity laws and regulations we must comply with also are subject to change. For example, the United Kingdom has enacted a Data Protection Act, and has implemented legislation referred to as the "UK GDPR," which substantially implement the GDPR in the United Kingdom. This legislation provides for substantial penalties for noncompliance of up to the greater of £17.5 million or four percent of the previous year’s annual revenues. While the European Union has deemed the United Kingdom an "adequate country" to which personal data could be exported from the European Economic Area ("EEA"), this decision is required to be renewed in 2025 and may be modified, revoked, or challenged in the interim, creating uncertainty regarding transfers of personal data to the United Kingdom from the EEA, particularly in light of modifications to the Data Protection Act and UK GDPR in the Data (Use and Access) Bill, which received Royal Assent on June 19, 2025, and aims to modernize and streamline the UK's data protection framework. It remains unclear how United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the United Kingdom will be regulated. Additionally, we have self-certified under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the United Kingdom extension to the EU-U.S. Data Privacy Framework, and have adopted certain standard contractual clauses approved by the European Commission ("SCCs") as part of our data processing agreements with regard to certain transfers of personal data from the EEA to the U.S. Both the EU-U.S. Data Privacy Framework and SCCs have, however, been subject to legal challenge. In its July 16, 2020 opinion, the CJEU imposed additional obligations on companies when relying on SCCs to transfer personal data. The European Commission has published revised SCCs addressing the CJEU concerns on June 4, 2021, that are required to be implemented. The United Kingdom has adopted new standard contractual clauses ("UK SCCs"), that became effective as of March 21, 2022, and which also are required to be implemented. The EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, United Kingdom extension to the EU-U.S. Data Privacy Framework, revised SCCs and UK SCCs, guidance and opinions of