Company: BLND
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001855747-25-000092
Chunk: 235

Company: Blend Labs, Inc.
Filing Date: 2025-11-06
Form: 10-Q
Item: Part I, Item 4
Chunk 235
---
 we have incurred, and may continue to incur, significant expenses in an effort to comply with privacy, data protection, and information security standards and protocols imposed by law, regulation, industry standards, contractual obligations, or other actual or asserted obligations, and may face substantial challenges in our efforts to do so. We may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so. 

70

As our business grows, we may become subject to privacy, data protection, and information security laws from jurisdictions outside of the United States, potentially including the General Data Protection Regulation (“GDPR”). The GDPR governs the collection, use, disclosure, transfer or other processing of personal data of European persons. Among other things, the GDPR imposes requirements regarding the security of personal data and notification of data processing obligations to competent national data processing authorities, provides for lawful bases on which personal data can be processed, provides for an expansive definition of personal data and requires changes to informed consent practices. In addition, the GDPR provides for heightened scrutiny of transfers of personal data from the European Economic Area (“EEA”) to the United States and other jurisdictions that the European Commission does not recognize as having “adequate” data protection laws, and imposes substantial fines for breaches and violations (up to the greater of €20 million or 4% of an enterprise’s consolidated annual worldwide gross revenue). The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations. The United Kingdom has implemented legislation that substantially implements the GDPR in the United Kingdom, which legislation provides for penalties for violations of up to the greater of £17.5 million or 4% of an enterprise’s consolidated annual worldwide gross revenue. The United Kingdom made targeted amendments to this legislation in the Data (Use and Access) Act 2025, which received Royal Assent on June 19, 2025. If we expand our business into the EEA and/or the United Kingdom, we will need to comply with their laws addressing privacy, data protection, and information security. This will involve significant resources and expense and may also impair our ability to offer our existing or planned features, products and services and/or increase our cost of doing business. 

Despite our efforts to comply with applicable laws, regulations, and other obligations relating to privacy, data protection, and information security, it is possible that our interpretations of the law, practices, or