Company: NCNO
Filing Date: 2025-04-01
Form Type: 10-K
Source: 0001902733-25-000026
Chunk: 84

Company: nCino, Inc.
Filing Date: 2025-04-01
Form: 10-K
Item: Item 1A
Chunk 84
---
 new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It has also created a new California data protection agency authorized to issue substantive regulations which could result in increased privacy and information security enforcement. The CCPA includes a number of limited exceptions, including an exception for data that is collected, processed, sold or disclosed pursuant to the Gramm-Leach-Bliley-Act (“GLBA”) and an exemption that includes some types of data covered by the Fair Credit Recording Act (“FCRA”).  These exceptions, however, do not apply to the private cause of action afforded to individuals for negligent information security incidents.  Additionally, the CCPA applies to the personal information of California residents collected in the employment, job applicant and business-to-business settings.

Twenty U.S. states have enacted comprehensive privacy laws and several others are proposing and enacting laws and regulations that impose obligations similar to the CCPA or that otherwise involve significant obligations and restrictions. Although many such state laws do not apply to FIs (or to data) subject to the GLBA, and some exempt all commercial- and employment-related data, these are evolving laws and regulations that add layers of complexity to compliance in the U.S. market.  If passed, such laws will require additional resources to ensure compliance, and may have potentially conflicting requirements that would make compliance challenging. 

GLBA and FCRA impose privacy and information security requirements on FIs, including obligations to protect and safeguard consumers’ nonpublic personal information and creditworthiness information, respectively, and limitations on the use and disclosure of such information.  The GLBA requires appropriate administrative, technical and physical safeguards to ensure the security, confidentiality, integrity, availability and the proper disposal of nonpublic personal information, and the FCRA imposes similar information security requirements regarding the protection of creditworthiness information. 

14

The Federal Trade Commission (“FTC”) and many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the collection, use, dissemination and security of health-related and other personal information and in particular health information. Courts may also adopt the standards for fair information practices promulgated by the FTC, which concern consumer notice, choice, security and access. Consumer protection laws require us to publish statements that describe how we handle personal information and choices individuals may have about the way we handle their personal information. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Furthermore,