Company: PGYWW
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001883085-25-000050
Chunk: 193

Company: Pagaya Technologies Ltd.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1A
Chunk 193
---
 sharing, and disclosure of various types of information including financial information and other personal information, and may mean we become bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters that may further change as laws, rules, and regulations evolve. Complying with these requirements and changing our policies and practices may be onerous and costly, and we may not be able to respond quickly or effectively to regulatory, legislative and other developments. These changes may in turn impair our ability to offer our existing or planned products and services and/or increase our cost of doing business.

Additionally, we have incurred, and may continue to incur, significant expenses in an effort to comply with privacy, cybersecurity, data protection, and information security standards and protocols imposed by law, regulation, industry standards, or contractual obligations. In particular, with laws and regulations such as the FCRA, GLBA, CCPA, CDPA, CPA and potentially other laws and regulations that may be proposed or amended, imposing new and relatively burdensome obligations, and with substantial uncertainty over the interpretation and application of these and other laws and regulations, we may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so.

As our business grows, we must also remain compliant with privacy and data security laws from other jurisdictions outside of the United States and Israel, including the European Union’s General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s GDPR (“UK GDPR”). The EU GDPR and the UK GDPR govern the collection, use, disclosure, transfer or other processing of personal data of persons located in the European Economic Area (the “EEA”) and the United Kingdom and the data practices of companies operating in the EEA and the United Kingdom, respectively. Among other things, the EU GDPR and the UK GDPR impose requirements regarding the security of personal data and notification of data processing obligations to competent national data protection authorities, provide for lawful bases on which personal data can be processed, provide for an expansive definition of personal data and require changes to informed consent practices. In addition, the EU GDPR and the UK GDPR provide for heightened scrutiny of transfers of personal data from the EEA and the United Kingdom, to the United States and other jurisdictions that local regulators do not recognize as having “adequate” data protection laws, and impose substantial fines for breaches and violations (up to the greater of €20 million under the EU GDPR, £17.5 million under the UK GDPR or, in each case