Company: SERV
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0001832483-25-000010
Chunk: 94

Company: Serve Robotics Inc. /DE/
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1A
Chunk 94
---
 and other privacy- and security-related incidents and may face increased costs and requirements to expend substantial resources in the event of an actual or perceived privacy or security breach or other incident.

We are subject to evolving laws, regulations, standards, policies, and contractual obligations related to data privacy and security laws and regulations, and our actual or perceived failure to comply with such obligations could harm our reputation, subject us to significant fines and liability, or otherwise adversely affect our business, prospects, financial condition and operating results.

We are subject to or affected by a number of federal, state and local laws and regulations, as well as contractual obligations and industry standards, that impose certain obligations and restrictions with respect to data privacy and security, and govern our collection, storage, retention, protection, use, processing, transmission, sharing and disclosure of personal information, including that of our employees, customers and others. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities and others of security breaches involving certain types of data. Such laws may be inconsistent or may change or additional laws may be adopted. In addition, our agreements with certain customers may require us to notify them in the event of a security breach. Such mandatory disclosures are costly, could lead to negative publicity, result in penalties or fines, result in litigation, may cause our customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security breach.

The global data protection landscape is rapidly evolving, and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. We may not be able to monitor and react to all developments in a timely manner. For example, California adopted the California Consumer Privacy Act (“CCPA”), which became effective in January 2020. The CCPA establishes a privacy framework for covered businesses, including an expansive definition of personal information and data privacy rights for California residents. The CCPA includes a framework with potentially severe statutory damages and private rights of action. The CCPA requires covered businesses to provide new disclosures to California residents, provide them new ways to opt-out of certain disclosures of personal information, and allow for a new cause of action for data breaches. Additionally, a new privacy law, the California Privacy Rights Act (“CPRA”), was approved by California voters in the November 3, 2020 election. The CPRA creates obligations relating to consumer data 

23

beginning on January 1, 2022, with implementing regulations expected on or before July 1