Company: DOMO
Filing Date: 2025-04-04
Form Type: 10-K
Source: 0001505952-25-000045
Chunk: 76

Company: DOMO, INC.
Filing Date: 2025-04-04
Form: 10-K
Item: Item 1A
Chunk 76
---
 imposed additional obligations in connection with the use of the SCCs. The Swiss data protection and information commissioner subsequently concluded that the Swiss-U.S. Privacy Shield was invalid on similar grounds. The European Commission issued new SCCs on June 4, 2021, addressing aspects of the CJEU’s opinion in the Schrems II case, which were required to be implemented. The European Commission and United States agreed in principle in March 2022 to a new EU-U.S. Data Privacy Framework (DPF), with respect to the European Commission adopted an adequacy decision in July 2023, allowing the DPF to be implemented and available for participating entities to use to legitimize transfers of personal data from the E.U. to the U.S. We have self-certified to the DPF, the Swiss-U.S. Data Privacy Framework, and the United Kingdom Extension to the DPF. The DPF has faced legal challenge, and each of these frameworks may be subject to legal challenge in the future. Additionally, the European Commission’s adequacy decision regarding the DPF provides that it will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. Numerous laws and regulations in other jurisdictions also have been enacted or modified in manners imposing data transfer restrictions, and we and many other companies may need to implement different or additional measures to establish or maintain legitimate means for the transfer and receipt of personal data from the E.U., Switzerland, the United Kingdom, or other countries or regions to the U.S., and we may, in addition to other impacts, be required to engage in additional contractual negotiations and experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators to apply different standards to the transfer of personal data from the E.U., Switzerland, the United Kingdom, or other regions to the U.S., and to block or require additional measures taken with respect to certain data flows from the E.U., Switzerland, the United Kingdom, or other regions to the U.S. We and our customers may face a risk of enforcement actions or other proceedings by regulatory authorities relating to personal data transfers. Any such proceedings could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results, and financial condition. We may be at risk of experiencing reluctance or refusal of European or multi-national customers to use our solutions and being subject to regulatory action or incurring penalties. Any of these developments may have an adverse effect on our business