Company: G
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001398659-25-000035
Chunk: 57

Company: Genpact LTD
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 57
---
 privacy laws, and some other states have enacted privacy laws that specifically regulate consumer health data or biometric data. These state privacy laws generally require that the use, retention, and sharing of personal information of residents be reasonably necessary and proportionate to the purposes of collection or processing, that businesses provide notice to data subjects regarding the information collected about them and how such information is used and shared, and provide data subjects the right to opt out of sales of their personal information and, in some cases, request the erasure of their personal information. Such laws, whether currently in effect or becoming effective in the future, carry substantial penalties for non-compliance, and any potential enforcement actions brought under these laws could lead to both business and reputational harm. 

Legislation enacted in certain European jurisdictions, and any future legislation in Europe, Japan or any other region or country in which we have clients restricting the performance of managed services from an offshore location or imposing burdens on companies that outsource data processing functions, could also have a material adverse effect on our business, results of operations and financial condition. For example, the legal mechanisms for transferring personal data from the EU to other countries continue to evolve in response to legislation, rulemaking, and litigation. The validity of approved standard contractual clauses, an alternative mechanism for personal data transfers outside of the EU, as a basis 

29

for transferring personal data outside of the EU may be challenged and require further rulemaking by the applicable legal bodies.

With the withdrawal of the UK from the EU, the UK amended its Data Protection Act 2018 to retain UK national data protection law comparable to the EU’s GDPR. The potential divergence between EU and UK requirements and practices may impose additional expense, administrative burdens, regulatory uncertainty, and enforcement risk associated with transferring personal data from the UK and EU to the U.S. The UK's exit from the EU and associated changes in trade relations could also result in increased costs, delays, and regulatory complexity in our business involving the UK. 

Additionally, legislation enacted in the UK and by many EU countries provides that if a company outsources all or part of its business to a service provider or changes its current service provider, the affected employees of the company or of the previous service provider are entitled to become employees of the new service provider, generally on the same terms and conditions as their original employment. In addition, dismissals of employees who were employed by the company or the previous service provider immediately prior to that outsourcing, if the dismissals resulted solely or principally from the outsourcing, are automatically considered unfair dismiss