Company: MMI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001578732-25-000015
Chunk: 66

Company: Marcus & Millichap, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 66
---
 and such actions jeopardize any personally identifiable information. In addition, concern among potential buyers or sellers about our privacy practices could keep them from using our services or require us to incur significant expense to alter our business practices or educate them about how we use personally identifiable information.

Our business is subject to complex and evolving laws and regulations regarding privacy, data protection, and cybersecurity. Many of these laws and regulations are subject to change and uncertain interpretation and could result in claims, increased cost of operations or otherwise harm our business.

We are subject to numerous laws and regulations regarding privacy, data protection and cybersecurity that govern the processing of certain data (including personal information, sensitive information, health information, and other regulated data). These laws and regulations are increasing in severity, complexity and number, change frequently, and increasingly conflict among the various jurisdictions in which we operate, which has resulted in greater compliance risk and cost for us.

In addition, we are also subject to the possibility of security breaches and other incidents, which themselves may result in a violation of these laws. We are also subject to an increasing number of reporting obligations in respect of material cybersecurity incidents. These reporting requirements have been proposed or implemented by a number of regulators in different jurisdictions, may vary in their scope and application, and could contain conflicting requirements. Certain of these rules and regulations may require us to report a cybersecurity incident before we have been able to fully assess its impact or remediate the underlying issue. Efforts to comply with such reporting requirements could divert management’s attention from our cybersecurity incident response and could potentially reveal system vulnerabilities to threat actors.

Failure to timely report cybersecurity incidents under these rules could also result in regulatory investigations, litigation, monetary fines, sanctions, or subject us to other forms of liability.

A significant actual or potential theft, loss, corruption, exposure, fraudulent use or misuse of client, employee or other personal information or proprietary business data, whether by third parties or as a result of employee malfeasance or otherwise, perceived or actual non-compliance with our contractual or other legal obligations regarding such data or intellectual property or a violation of our privacy and security policies with respect to such data could result in significant 

21

remediation and other costs, fines, litigation or regulatory actions against us. Such an event could additionally disrupt our operations and the services we provide to clients, harm our relationships with contractors and vendors, damage our reputation, result in the loss of a competitive advantage, impact our ability to provide timely and accurate financial data and cause a loss of confidence in our services and financial reporting, which could