Company: G
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001398659-25-000035
Chunk: 29

Company: Genpact LTD
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1
Chunk 29
---
 is subject to the oversight of our supervisory authority, the Romanian National Supervisory Authority for Personal Data Processing. Changes to the GDPR, SCCs, adequacy decisions, our BCRs, or changes in oversight or enforcement priorities could create uncertainty around international transfers of data and may require Genpact to modify its approach.

Following the withdrawal of the UK from the EU, the UK has amended the UK Data Protection Act 2018 to retain the GDPR in UK national law. The penalties prescribed in the UK GDPR are the same as under the EU GDPR. However, the UK has implemented its own guidance for handling outbound data transfers to jurisdictions, such as the U.S., whose privacy laws are not covered by an existing adequacy decision and has adopted an International Data Transfer Agreement as a framework for companies to transfer personal data outside of the UK.

Additionally, foreign governments outside of the EU and UK are also taking steps to fortify their data privacy laws and regulations. For example, India recently enacted a data protection law that will affect how we handle vendor and employee data in India. Other countries in Africa, Asia and Latin America have either passed data privacy legislation or are considering data protection laws that affect or may affect us. As privacy laws and regulations around the world continue to evolve, these changes could adversely affect our business operations, websites and mobile applications that are accessed by residents in the applicable countries.  

In the United States, we are either directly subject to, or contractually required to comply or facilitate our clients’ compliance with, laws and regulations arising out of our work for clients operating there, especially in the area of banking, financial services and insurance, such as the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, the Fair and Accurate Credit Transactions Act, the Right to Financial Privacy Act, the Bank Secrecy Act, the USA PATRIOT Act, the Bank Service Company Act, the Home Owners Loan Act, the Electronic Funds Transfer Act, the Equal Credit Opportunity Act, executive action and regulation by U.S. agencies such as the Securities and Exchange Commission ("SEC"), the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration, the Commodity Futures Trading Commission, the Federal Financial Institutions Examination Council, the Office of the Comptroller of the Currency, the Consumer Financial Protection Bureau and the Department of Justice. Additionally, in Australia and the EU, we are either directly subject to, or contractually required to comply or facilitate our clients’ compliance with, regulations addressing organizational resilience.

Because of our debt