Company: HCKT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-030037
Chunk: 15

Company: HACKETT GROUP, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 15
---
 this regard will be adequate to deter misappropriation of our IP, or that we will be able to detect unauthorized use and take appropriate steps to enforce our IP rights.

Although we believe that our services do not infringe on the IP rights of others and that we have all rights necessary to utilize the IP employed in our business, we are subject to the risk of claims alleging infringement of third-party IP rights. Any claims could require us to spend significant sums in litigation, pay damages, develop non-infringing IP or acquire licenses to the IP that is the subject of asserted infringement.

Data privacy and information security may require significant resources and presents certain risks. 

We collect, store, have access to and otherwise process certain confidential or sensitive data, including proprietary business information, personal data or other information that is subject to privacy and security laws, regulations and/or customer-imposed controls. We operate in an environment in which data privacy regulatory and legal framework is evolving quickly and varies by jurisdiction. We cannot predict the cost of compliance with future data privacy laws, regulations and standards, or future interpretations of current laws, regulations and standards, related to privacy and cybersecurity or the potential effects on our business.  

As a company doing business in Europe, we are also subject to European data protection laws and regulations. The European Union General Data Protection Regulation (“GDPR”), imposes stringent requirements in how we collect and process personal data and provides for significantly greater penalties for noncompliance; and several other countries have passed laws that require personal data relating to their citizens to be maintained on local servers and impose additional data transfer restrictions. In addition, we are also subject to and affected by new state privacy and data security laws such as the California Consumer Privacy Act (“CCPA”). The CCPA imposes additional data privacy requirements on many businesses operating in the state, including, potentially, with respect to employee data.  Several states have enacted or introduced varying comprehensive privacy laws modeled to some degree on the CCPA and/or the GDPR. Compliance with multiple country and state laws containing varying requirements could be complicated and costly.  Government enforcement actions can be costly and interrupt the regular operation of our business, and violations of data privacy laws can result in fines, reputational damage and civil lawsuits, any of which may adversely affect our business, reputation and financial statements.