Company: WKC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001628280-25-007620
Chunk: 158

Company: WORLD KINECT CORP
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 158
---
 business or on the businesses of our customers.

18

Table of Contents

The data that we collect may be vulnerable to cybersecurity incidents, breach, loss or misuse, and our handling of such data may be impacted by changes in data privacy and protection laws and regulations, which could increase operational costs or result in regulatory penalties or litigation.

We have access to sensitive, confidential or personal data from our employees, customers (both corporate and individual consumers), suppliers and other third parties, some of which is subject to privacy, security or residency or localization laws, regulations and customer-imposed controls. In the ordinary course of business, we collect, retain, process, and transmit such data across national boundaries. Despite our efforts to properly handle and protect this information in compliance with such requirements, our facilities and systems and those of our third-party service providers and business partners may be vulnerable to cybersecurity incidents, security breaches, theft, misplaced or lost data, and programming, technical failures or disruptions, and procedural or human errors that may lead to such information being compromised or handled improperly.

There has been increased public attention regarding the use of personal data and security of data transfers, accompanied by legislation and regulations intended to strengthen data protection, information security and consumer and personal privacy. The evolving nature of privacy laws in the U.S., the E.U., China, Australia and other jurisdictions where we have operations and customers, could impact our processing of this data, including requiring us to make costly changes to our IT systems to properly handle such data. For example, the E.U.'s General Data Protection Regulation imposes strict rules on handling personal data related to the E.U. and imposes significant sanctions for violations. We have substantial operations in the E.U. and are therefore subject to these heightened standards. Similarly, the California Consumer Privacy Act grants certain rights to California residents with respect to their personal data and requires that companies take or refrain from taking certain actions. Several other U.S. states have enacted similar data privacy legislation, and additional states have passed or are considering additional privacy laws that are expected to take effect in the near future. 

Our failure to adequately comply with these requirements could lead to substantial fines, penalties, third-party liability, remediation costs, litigation (including class action or commercial litigation), regulatory investigations and actions, potential cancellation of existing contracts and the inability to compete for future business. Any significant breach of data privacy-related regulations or related customer requirements could have a material adverse effect on our business and reputation, as well as our financial condition, results of operations and cash flows.

Our international operations subject