Company: RSKD
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001851112-25-000006
Chunk: 83

Company: RISKIFIED LTD.
Filing Date: 2025-03-06
Form: 20-F
Item: Item 4
Chunk 83
---
 the UK government has indicated its intention to diverge from the EU’s privacy framework. These prospective changes are yet to be confirmed in law but may require us to make changes to our data privacy compliance operations and/ or to our business practices and may result in substantial costs, which in turn may compromise our growth strategy and otherwise adversely affect our business.

The EU GDPR and UK GDPR impose significant penalties for non-compliance (up to EUR 20 million for the most serious breaches of the EU GDPR, or GBP 17.5 million in the case of the UK GDPR or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher).

We are also subject to evolving EU and UK privacy laws on cookies, tracking technologies and e-marketing. In the EU and UK, informed consent is required for the placement of certain cookies or similar tracking technologies on an individual’s device and for direct electronic marketing. Consent is tightly defined and includes a prohibition on pre-checked consents and a requirement to obtain separate consents for each type of cookie or similar technology. Recent European court and regulator decisions are driving increased attention to cookies and similar tracking technologies.

On December 16, 2020, the European Union published a new cybersecurity strategy which aims at adapting online and offline security requirements in response to growing interconnectedness and digitization. In December 2022, the Directive (EU) 2022/2555 of the European Parliament and of the Council of December 14, 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148, or the NIS 2 Directive, was published in the official journal of the European Union. As EU Member States were required to adopt the NIS 2 Directive into national law by October 17, 2024, however, not all of them have done this yet, so it is difficult to assess the impact on our business or operations, but it may require us to modify our cybersecurity practices and policies and we could incur substantial costs as a result.

On November 1, 2022, the Digital Markets Act, or the DMA, entered into force and on November 16, 2022, the Digital Services Act, or the DSA, followed. As further guidance is issued and interpretation of both the DSA and the DMA evolves, it is difficult to assess the