Company: SKLZ
Filing Date: 2025-11-06
Form Type: 10-K
Source: 0001801661-25-000050
Chunk: 58

Company: Skillz Inc.
Filing Date: 2025-11-06
Form: 10-K
Item: Item 1A
Chunk 58
---
 liability for failing to meet such obligations. The GDPR, together with national legislation, regulations and guidelines of the EU member states and the United Kingdom governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, use, retain, protect, disclose, transfer and otherwise process personal data. In particular, the GDPR includes obligations and restrictions concerning data transparency and consent, the overall rights of individuals to whom the personal international data relates, the transfer of personal data out of the European Economic Area ("EEA") or the United Kingdom, security breach notifications restrictions and the security and confidentiality of personal data. The GDPR authorizes fines for certain violations of up to 4% of global annual revenue or €20 million, whichever is greater. Recent legal developments in Europe have created further complexity and uncertainty regarding transfers of personal data from the EEA and the United Kingdom to the United States. In July 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S. Privacy Shield Framework (“Privacy Shield”) under which personal data could be transferred from the EEA to the United States. While the CJEU upheld the adequacy of standard contractual clauses, a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism and potential alternative to the Privacy Shield, it made clear that reliance on them alone may not necessarily be sufficient in all circumstances. Further, the United Kingdom’s decision to leave the EU has created uncertainty with regard to data protection regulation in the United Kingdom. As of January 1, 2021, we are also subject to the UK GDPR and UK Data Protection Act of 2018, which retain the GDPR in the United Kingdom’s national law. These laws require us to review and amend the legal mechanisms by which we make and/or receive personal data transfers. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses and other mechanisms cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it 

31

could affect the manner in which we do business, the geographical location or segregation of our relevant operations, and could adversely affect our financial results. 

Compliance with GDPR, CCPA, COPPA and similar legal requirements has required us to devote significant operational resources and incur significant expenses. We expect the number of jurisdictions adopting their own data privacy laws to increase,