Company: KHC
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001637459-25-000011
Chunk: 72

Company: Kraft Heinz Co
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1A
Chunk 72
---
 incidents resulting from unauthorized access to or use of our systems or those of third parties, which to date, have not had a material impact on our operations; however, there is no assurance that the impact of any security incidents will not be material in the future.

In addition, if we are unable to prevent security breaches or disclosure of non-public information, we may suffer financial and reputational damage, litigation or remediation costs, fines, or penalties because of the unauthorized disclosure of confidential information belonging to us or to our partners, customers, consumers, or suppliers. While we maintain a cyber insurance policy that provides coverage for security incidents, we cannot be certain that our coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on financially reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim.

Misuse, leakage, or falsification of information could result in violations of data privacy laws and regulations, damage to our reputation and credibility, loss of opportunities to acquire or divest of businesses or brands, and loss of our ability to commercialize products developed through research and development efforts and, therefore, could have a negative impact on net sales. In addition, we may suffer financial and reputational damage because of lost or misappropriated confidential information belonging to us, our current or former employees, or to our suppliers or consumers, and may become subject to legal action and increased regulatory oversight. We could also be required to spend significant financial and other resources to remedy the damage caused by a security breach or to repair or replace networks and information systems.

We are also subject to various laws and regulations that are continuously evolving and developing regarding privacy, data protection, and data security, including those related to the collection, storage, handling, use, disclosure, transfer, and security of personal data. Such laws and regulations, as well as their interpretation and application, may vary from jurisdiction to jurisdiction, which can result in inconsistent or conflicting requirements. The European Union’s General Data Protection Regulation (“GDPR”), and similar regulations implemented in other non-U.S. geographies, adds a broad array of requirements with respect to personal data, including the public disclosure of significant data breaches, and imposes substantial penalties for non-compliance. The California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), which amended the CCPA, among other things, impose additional requirements with respect to disclosure and deletion of personal information of California residents. The CCPA and CPRA provide civil penalties for violations, as