Company: CALX
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001406666-25-000045
Chunk: 235

Company: CALIX, INC
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 4
Chunk 235
---
 total worldwide annual turnover of the preceding financial year; thus, any non-compliance with the GDPR could result in a material adverse effect on our business, financial condition and results of operations.

The EU GDPR and UK GDPR regulate cross-border transfers of personal data out of the European Economic Area, or the EEA, and the UK. There is currently legal complexity and uncertainty regarding international personal data transfers, and we expect this to continue. For example, there are number of decisions and proceedings in the EU where the legality of data transfers to China is being challenged. As the regulatory guidance and enforcement landscape in relation to data transfers further develops, our business, operations and financial condition could be adversely affected and we could suffer additional costs, complaints and/or regulatory investigations or fines. We may also have to stop using certain tools and vendors and make other operational changes. Further, our customers may not use our services in a manner that is compliant with applicable data privacy laws and regulations and our services may not be competitive in certain markets..  We may also become subject to new laws that regulate non-personal data. For example, the European Union’s Data Act imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, which may lead to the exercise of early termination rights. Depending on how this Act and any similar laws are implemented and interpreted, we may have to adapt our business practices, contractual arrangements, and solutions to comply with such laws.

In addition, security regulations such as the EU’s Network and Information Security 2 Directive (NIS2) and its EU Member State transpositions, and the UK’s Telecommunications (Security) Act 2021 together with its implementing regulations impose further security obligations, including on electronic communications networks and services. We may be required to implement (and contractually commit to) additional security measures to remain a competitive vendor, as customers will need to ensure their vendors are able to meet the obligations that they are themselves subject to, or customers may choose different vendors due to our security measures. This could result in additional costs and require operational changes which could adversely affect our business, operations and financial condition.

In light of the complex and evolving nature of EU, EU Member State and UK data and security laws, there can be no assurances that we will be successful in our efforts to comply with such laws; violations of such laws could result in regulatory investigations, fines, orders to cease/change our use of technologies and/or our processing activities, enforcement notices and assessment notices (for a compulsory audit