Company: BLND
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001855747-25-000092
Chunk: 526

Company: Blend Labs, Inc.
Filing Date: 2025-11-06
Form: 10-Q
Item: Part I, Item 8
Chunk 526
---
 United States, potentially including the General Data Protection Regulation (“GDPR”). The GDPR governs the collection, use, disclosure, transfer or other processing of personal data of European persons. Among other things, the GDPR imposes requirements regarding the security of personal data and notification of data processing obligations to competent national data processing authorities, provides for lawful bases on which personal data can be processed, provides for an expansive definition of personal data and requires changes to informed consent practices. In addition, the GDPR provides for heightened scrutiny of transfers of personal data from the European Economic Area (“EEA”) to the United States and other jurisdictions that the European Commission does not recognize as having “adequate” data protection laws, and imposes substantial fines for breaches and violations (up to the greater of €20 million or 4% of an enterprise’s consolidated annual worldwide gross revenue). The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations. The United Kingdom has implemented legislation that substantially implements the GDPR in the United Kingdom, which legislation provides for penalties for violations of up to the greater of £17.5 million or 4% of an enterprise’s consolidated annual worldwide gross revenue. The United Kingdom made targeted amendments to this legislation in the Data (Use and Access) Act 2025, which received Royal Assent on June 19, 2025. If we expand our business into the EEA and/or the United Kingdom, we will need to comply with their laws addressing privacy, data protection, and information security. This will involve significant resources and expense and may also impair our ability to offer our existing or planned features, products and services and/or increase our cost of doing business. 

Despite our efforts to comply with applicable laws, regulations, and other obligations relating to privacy, data protection, and information security, it is possible that our interpretations of the law, practices, or platform could be inconsistent with, or fail or be alleged to fail to meet all requirements of, such laws, regulations, or actual or asserted obligations. Our failure, or the failure by our partners, vendors, service providers, or customers, to comply with applicable laws or regulations, policies, documentation, contractual obligations, or any other actual or asserted obligations relating to privacy, data protection, or information security, or any compromise of security that results in unauthorized access to, or use, release, disclosure, or other processing of data relating to consumers or other individuals, or the perception that any of