Company: G
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001398659-25-000035
Chunk: 28

Company: Genpact LTD
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1
Chunk 28
---
 willingness of our clients and prospective clients to utilize our services.” 

15

Our collection, use, disclosure and retention of personal health-related and other information is subject to an array of privacy, data security, and data breach notification laws and regulations that change frequently, are inconsistent across the jurisdictions in which we do business, and impose significant compliance costs. In the United States, personal information is subject to numerous federal and state laws and regulations relating to privacy, data security, and breach notification, including, for example, the Financial Modernization Act (sometimes referred to as the Gramm-Leach-Bliley Act), Health Insurance Portability and Accountability Act, Federal Trade Commission Act, Family Educational Rights and Privacy Act, Communications Act, Electronic Communications Privacy Act, and state-level comprehensive privacy laws, including the California Consumer Privacy Act.  There are also various state-level privacy laws that specifically regulate consumer health data.

All fifty U.S. states and the District of Columbia have implemented separate data security breach notification laws with which we must comply, and some states have added specific data security standards to their existing laws. 

Some courts have become more willing to allow individuals to pursue claims in data breach cases, indicating that it may become easier for consumers to sue companies for data breaches. Related laws and regulations govern our direct marketing activities and our use of personal information for direct marketing, including the Telemarketing and Consumer Fraud and Abuse Prevention Act, Telemarketing Sales Rule, Telephone Consumer Protection Act and rules promulgated by the Federal Communications Commission, and CAN-SPAM Act. In 2018, the Clarifying Lawful Overseas Use of Data Act established new required processes and procedures for handling U.S. law enforcement requests for data that we may store outside of the U.S. 

In the EU, the General Data Protection Regulation ("GDPR") went into effect in May 2018. The GDPR imposes privacy and data security compliance obligations and increased penalties for noncompliance. In particular, the GDPR has introduced numerous privacy-related changes for companies operating in the EU, including greater control for data subjects, increased data portability for EU consumers, data breach notification requirements and increased fines for violations. The GDPR also prohibits the transfer of personal data from the European Economic Area (“EEA”) to countries outside of the EEA unless an appropriate data transfer mechanism has been put in place. Such mechanisms include adequacy decisions, standard contractual clauses ("SCCs") and binding corporate rules ("BCRs"). Our BCR for data processors was approved in May 2024 and