Company: DNLI
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001714899-25-000193
Chunk: 53

Company: Denali Therapeutics Inc.
Filing Date: 2025-11-06
Form: 10-Q
Item: Part I, Item 2
Chunk 53
---
 in Medicare, Medicaid, and other federal healthcare programs, contractual damages, reputational harm, diminished profits and future earnings, and curtailment of our operations, any of which could adversely affect our ability to operate our business and our results of operations. In addition, the approval and commercialization of any of our product candidates outside the United States will also likely subject us to foreign equivalents of the healthcare laws mentioned above, among other foreign laws.

Our business is subject to complex and evolving U.S. and foreign laws and regulations, information security policies, and contractual obligations relating to privacy and data protection and security, including the use, processing, and cross-border transfer of personal information. These laws and regulations are subject to change and uncertain interpretation, and could result in claims, changes to our business practices, or monetary penalties, and otherwise may harm our business.

We receive, generate, store, and otherwise process significant and increasing volumes of sensitive information and business-critical information, including employee and personal data (including protected health information), research and development information, commercial information, and business and financial information. We heavily rely on external security and infrastructure vendors to manage our information technology systems and data centers. We face a number of risks relative to protecting this critical information, including the loss of access, inappropriate use or disclosure, inappropriate modification, and the risk of our being unable to adequately monitor, audit, and modify our controls over our critical information. This risk extends to third-party vendors and subcontractors we use to manage this sensitive data.

A wide variety of provincial, state, national, and international laws and regulations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of data relating to individuals. These laws and regulations are evolving and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, the collection and use of personal data in the EU are governed by the EU General Data Protection Regulation ("GDPR"), which became fully effective on May 25, 2018. The GDPR imposes stringent data protection requirements, including, for example, more robust disclosures to individuals and a strengthened individual data rights regime, shortened timelines for data breach notifications, limitations on retention of information, increased requirements pertaining to special categories of data, such as health data, and additional obligations when we contract with third-party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the EU to the United States and other countries, and in the context of clinical trials we