Company: AIP
Filing Date: 2025-08-05
Form Type: 10-Q
Source: 0001667011-25-000029
Chunk: 323

Company: Arteris, Inc.
Filing Date: 2025-08-05
Form: 10-Q
Item: Part I, Item 8
Chunk 323
---
 General Data Protection Regulation and the U.K. Data Protection Act 2018 (UK GDPR) (collectively, the GDPR) imposes comprehensive data privacy compliance obligations on our collection, processing, sharing, disclosure, transfer and other use of data relating to an identifiable living individual or “personal data”. The EU and U.K. regimes also include laws which, among other things, require European Economic Area (EEA) member states and the U.K. to regulate marketing by electronic means and the use of cookies and similar technologies. The GDPR has resulted in, and will continue to result in, significant compliance burdens and costs for companies with customers and/or operations in the EEA and the U.K. The GDPR, and national implementing legislation in each member state, imposes a data protection compliance regime including: (i) providing detailed disclosures about how personal data is collected and processed; (ii) demonstrating that an appropriate legal basis is in place or otherwise exists to justify data processing activities; (iii) granting certain rights for data subjects in regard to their personal data (including transparency, the right to be “forgotten,” right to data portability, right of access, and right to rectification); (iv) obligation to notify data protection regulators or supervisory authorities (and in certain cases, affected individuals) of data breaches; (v) imposing limitations on retention of personal data; (vi) maintaining a record of data processing; and (vii) complying with the principal of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit. If our privacy or data security measures fail to comply with applicable current or future laws and regulations, we may be subject to litigation, regulatory investigations, and enforcement notices requiring us to change the way we use personal data or our marketing practices. For example, under the GDPR we may be subject to fines of up to €20 million / £17.5 million or up to 4% of the total worldwide annual group turnover of the preceding financial year (whichever is higher) for major violations. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease/ change our processing of our data, enforcement notices, and/ or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, reputational harm and a potential loss of business. 

We are