Company: DOMO
Filing Date: 2025-12-09
Form Type: 10-Q
Source: 0001628280-25-055921
Chunk: 36

Company: DOMO, INC.
Filing Date: 2025-12-09
Form: 10-Q
Item: Item 1A
Chunk 36
---
 cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, security, disclosure, and other processing of various types of data, including data that identifies or may be used to identify an individual. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Within the E.U., in May 2018, a far-reaching regulation governing data and privacy practices called the General Data Protection Regulation (GDPR) became effective. The GDPR includes stringent operational requirements for processors and controllers of personal data and imposes significant penalties for noncompliance of up to the greater of €20 million or 4% of global annual revenues. Complying with the GDPR, the CCPA, and other laws and regulations governing privacy, data protection, and cybersecurity may cause us to incur substantial operational costs or require us to modify our data handling practices. Actual or alleged noncompliance could result in proceedings against us by governmental entities or others (including a private right of action for affected individuals in certain instances) and substantial penalties, fines, and other liabilities, and may otherwise adversely impact our business, financial condition, and operating results.

Further, the United Kingdom has enacted a Data Protection Act and a version of the GDPR referred to as the UK GDPR that, collectively, substantially implement the GDPR in the United Kingdom and provide for penalties of up to the greater of £17.5 million and 4% of total annual revenue. Uncertainty remains, however, regarding aspects of data protection in the United Kingdom in the medium to long term, and the United Kingdom is contemplating new data protection legislation. On June 28, 2021, the European Commission announced a decision of “adequacy” concluding that the United Kingdom ensures an equivalent level of data protection to the GDPR, which provides some relief regarding the legality of continued personal data flows from the European Economic Area to the United Kingdom. This adequacy determination must be renewed, however, and may be modified or revoked in the interim. The United Kingdom has made certain modifications to its data protection regime in the UK Data (Use and Access) Act 2025 (DUAA), which was enacted on June 19, 2025. The European Commission has proposed to renew the UK’s adequacy decision after assessing the DUAA, but additional procedural steps remain, causing some uncertainty to remain regarding the UK’s adequacy determination. Further, United Kingdom data protection law imposes restrictions on personal data