Company: AIP
Filing Date: 2025-05-13
Form Type: 10-Q
Source: 0001667011-25-000022
Chunk: 74

Company: Arteris, Inc.
Filing Date: 2025-05-13
Form: 10-Q
Item: Part I, Item 3
Chunk 74
---
 our data, enforcement notices, and/ or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, reputational harm and a potential loss of business. 

We are also subject to European Union rules with respect to cross-border transfers of personal data out of the EEA and the U.K. In July 2020, the Court of Justice of the EU (CJEU) limited how organizations could lawfully transfer personal data from the EU/EEA to the United States by invalidating the Privacy Shield for purposes of international transfers and imposing further restrictions on the use of standard contractual clauses (SCCs). In March 2022, the US and EU announced the EU-U.S. DPF after determining that the additional safeguards included in Executive Order 14086 signed by former President Biden on October 7, 2022, provide an adequate level of protection for personal data transferred from the European Union. The adequacy decision allows the EU-U.S. DPF to facilitate the transfer of data from Europe to the United States. We currently rely on the SCCs to transfer personal data outside the EEA and the U.K., including to the U.S. As supervisory authorities issue further guidance on personal data export mechanisms, we could suffer additional costs, complaints and/or regulatory investigations or fines.

54

Further, the exit of the U.K. from the EU, often referred to as Brexit, created uncertainty with regard to data protection regulation in the U.K. The European Commission has adopted an adequacy decision in favor of the U.K., enabling data transfers from EU member states to the U.K. without additional safeguards. However, the U.K. adequacy decision will automatically expire in June 2025 unless the European Commission re-assesses and renews/ extends that decision and remains under review by the European Commission during this period. The relationship between the U.K. and the EU in relation to certain aspects of data protection law remains unclear, and it is unclear how U.K. data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the U.K. will be regulated in the long term. These changes will lead to additional costs and increase our overall risk exposure.

In addition, we are subject to evolving data privacy and security laws, rules and regulations in the PRC, particularly the Personal Information Protection