Company: VEEV
Filing Date: 2025-11-21
Form Type: 10-Q
Source: 0001393052-25-000078
Chunk: 294

Company: VEEVA SYSTEMS INC
Filing Date: 2025-11-21
Form: 10-Q
Item: Part I, Item 2
Chunk 294
---
 and lawsuits that, even if unsuccessful, could divert our resources and our management’s attention and adversely affect our business and customer relationships, and our insurance coverage may not be sufficient to cover such claims against us.

Increasingly complex regulations relating to privacy, data protection, and cybersecurity are burdensome, may reduce demand for our solutions, and non-compliance may impose significant liabilities.

Our customers use our solutions to collect, use, store, disclose, and otherwise process personal data regarding their employees, healthcare professionals, and patients. Patient data may include sensitive health data. In many countries, governmental bodies have adopted or may adopt laws and regulations regarding the security, collection, use, storage, disclosure, and other processing of personal data, making compliance an increasingly complex task.

Under the European General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s General Data Protection Regulation (“UK GDPR”), as amended by the Data (Use and Access) Act 2025, we act as a data controller for our data products and a data processor with respect to our software products. Each of the GDPR and UK GDPR impose significant data protection obligations and provide for substantial penalties and other remedies for noncompliance. We maintain active self-certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. We also rely on EU, Swiss, and UK Standard Contractual Clauses, as well as our technical, contractual, and security measures, to help ensure that our European customers have the appropriate legal mechanisms in place for their personal data to be accessed from within the United States. We are required to take steps to legitimize any personal data transfers impacted by these developments and similar developments in other jurisdictions, and to engage in contract negotiations with third parties that aid in processing personal data on our behalf. We may be subject to increased costs of compliance and limitations on our service providers and us. In addition, these laws are complex, with the application and interpretation of them, at times, unclear and inconsistent, and significant penalties may be imposed for non-compliance. For example, in May 2023, the Irish Data Protection Commission imposed a significant fine on a large internet technology corporation for its failure to sufficiently address risks to EU data subjects when transferring data to the U.S.

Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud