Company: NCNO
Filing Date: 2025-04-01
Form Type: 10-K
Source: 0001902733-25-000026
Chunk: 85

Company: nCino, Inc.
Filing Date: 2025-04-01
Form: 10-K
Item: Item 1A
Chunk 85
---
 according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5 of the FTC Act.

Privacy and cybersecurity laws continue to evolve to impose ever stricter standards for the collection, use, dissemination and security of personally identifiable information, including financial information.  Actual, potential, or perceived violations of such laws could result in regulatory investigations, fines, orders to cease/change our use of such technologies and processing of personal data, as well as civil claims including class actions, reputational damage and ongoing compliance costs, any of which could harm our business, results of operations and financial condition. Moreover, federal, and state regulation around AI may be enacted in the near future.

Similarly, the European Economic Area (the "EEA") (comprised of the EU Member States and Iceland, Liechtenstein and Norway) adopted the General Data Protection Regulation (2016/679) (the "EU GDPR") in May 2018 and the UK implemented the EU GDPR by virtue of section 3 of the European Union (Withdrawal) Act 2018 which sits alongside the UK Data Protection Act 2018 (known as the "UK GDPR", and together with the "EU GDPR", the "GDPR"). The GDPR has a direct effect where an entity is established in the EEA or the UK and has extra-territorial effect where an entity established outside of the EEA or UK processes personal data in relation to the offering of goods or services to individuals in the EEA and/or the UK or the monitoring of their behavior. The GDPR imposes a number of obligations on controllers, including, among others: (i) accountability and transparency requirements which require controllers to demonstrate and record compliance with the GDPR and to provide more detailed information to data subjects regarding processing; (ii) enhanced requirements for obtaining valid consent where consent is the lawful basis for processing; (iii) obligations to consider data protection as any new products or services are developed and to limit the amount of personal data processed; (iv) obligations to comply with data protection rights of data subjects including a right of access to and rectification of personal data, a right to obtain restriction of processing or to object to processing of personal data and a right to ask for a copy of personal data to be provided to a third party in a useable format and erasing personal data in certain circumstances and the right not to be subject to solely automated decision-making; (v) obligations to implement