Company: NET
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001477333-25-000141
Chunk: 89

Company: Cloudflare, Inc.
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 2
Chunk 89
---
 example, in July 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework, which generally allows the free flow of EU personal data to the United States for participating entities. While this framework currently serves as a means for cloud service providers like our company to freely transfer EU personal data to the United States, it may be subject to future legal challenges, suspension, amendment, repeal, or limitations to its scope by the European Commission. In addition, some customers and vendors may be unwilling to rely on this framework due to these and other uncertainties, including perceived uncertainty about the U.S. stance on the existing legal framework. In addition, in January 2023, the European Data Protection Board issued its 2022 Coordinated Enforcement Action on the use of cloud-based services by the public sector, in which it expressed concerns that EU public sector entities may not be able to use U.S.-based cloud service providers consistently with GDPR due to their concerns about the ability of U.S. government agencies to access EU personal data. Following that, the European Data Protection Supervisor found in March 2024 that the European Commission’s use of Microsoft 365 violated the GDPR in part due to EU personal data being transferred to countries that had not been determined by the EU to provide adequate level of protection suggests that EU regulators are continuing to subject data transfers outside the EU to careful scrutiny.

In addition, the United States has enacted the Protecting Americans' Data from Foreign Adversaries Act (PADFA), and the U.S. Department of Justice released a final rule, effective on April 8, 2025, implementing President Biden’s February 2024 Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern”, both of which restrict the transfer of certain types of data to named jurisdictions or covered entities. We have incurred additional costs and invested resources in addressing these new regulations, and as we continue to monitor the impact these new regulations have on our and our customers’ business, we may incur additional costs and may need to invest additional resources in order to make changes to our practices as may be required under these regulations.

Whether as a result of these developments or otherwise, we may continue to see more findings from regulators around the world against cloud service providers relating to cross-border personal data transfers, and may find it necessary or appropriate to modify our policies and practices to address any such findings or other legislative developments relating to cross-border personal data transfers. Implementing