Company: DOMO
Filing Date: 2025-09-05
Form Type: 10-Q
Source: 0001505952-25-000075
Chunk: 38

Company: DOMO, INC.
Filing Date: 2025-09-05
Form: 10-Q
Item: Item 1A
Chunk 38
---
 Framework, and the United Kingdom Extension to the DPF. The DPF has faced legal challenge, and each of these frameworks may be subject to legal challenge in the future. Additionally, the European Commission’s adequacy decision regarding the DPF provides that it will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. Numerous laws and regulations in other jurisdictions also have been enacted or modified in manners imposing data transfer restrictions, and we and many other companies may need to implement different or additional measures to establish or 

63

maintain legitimate means for the transfer and receipt of personal data from the E.U., Switzerland, the United Kingdom, or other countries or regions to the U.S., and we may, in addition to other impacts, be required to engage in additional contractual negotiations and experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators to apply different standards to the transfer of personal data from the E.U., Switzerland, the United Kingdom, or other regions to the U.S., and to block or require additional measures taken with respect to certain data flows from the E.U., Switzerland, the United Kingdom, or other regions to the U.S. We and our customers may face a risk of enforcement actions or other proceedings by regulatory authorities relating to personal data transfers. Any such proceedings could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results, and financial condition. We may be at risk of experiencing reluctance or refusal of European or multi-national customers to use our solutions and being subject to regulatory action or incurring penalties. Any of these developments may have an adverse effect on our business.

Other jurisdictions have adopted laws and regulations addressing privacy, data protection, and cybersecurity, many of which share similarities with the GDPR. For example, Law no. 13.709/2018 of Brazil, the Lei Geral de Proteção de Dados Pessoais (LGPD) entered into effect in 2020, authorizing a private right of action for violations. Penalties include fines of up to 2% of the organization’s revenue in Brazil in the previous year or 50 million Brazilian reais. The LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users who are located in Brazil. The LGPD provides users with similar rights as the GDPR regarding their data. Additionally, the Personal Information Protection Law (PIPL) of the People’s Republic of