Company: SYY
Filing Date: 2025-08-22
Form Type: 10-K
Source: 0000096021-25-000099
Chunk: 108

Company: SYSCO CORP
Filing Date: 2025-08-22
Form: 10-K
Item: Item 1A
Chunk 108
---
 enable more analytics for our sales consultants. Flaws, breaches or malfunctions in these systems could lead to operational disruptions, data loss, or erroneous decision-making, impacting our operations, financial condition and reputation. Legal challenges may arise, including cybersecurity incidents, non-compliance with data protection regulations, and lack of transparency. The legal and regulatory landscape and industry standards surrounding artificial intelligence technologies is rapidly evolving and remains uncertain, and compliance may impose significant operational costs and may limit our ability to develop, deploy or use artificial intelligence technologies. Furthermore, the deployment of artificial intelligence systems could expose us to increased cybersecurity threats, such as data breaches and unauthorized access leading to financial losses, legal liabilities, and reputational damage. We also face competitive risks if we fail to adopt artificial intelligence or other machine-learning technologies in a timely manner.

Our failure to comply with data privacy regulations could adversely affect our business.

Data privacy laws and the regulatory activity associated therewith, continue to evolve across most jurisdictions in which we operate. Given the complexity of these laws, uncertainty regarding their interpretation, application, and enforcement and the often-onerous requirements they place on businesses regarding the collection, storage, handling, use, disclosure, transfer, and security of personal data, it is important for us to understand their impact and respond accordingly. Failure to 

18

comply with data privacy laws can result in substantial fines or penalties, legal liability and / or reputational damage and litigation. 

In the UK and Europe, the General Data Protection Regulation (the GDPR) places stringent requirements on companies when handling personal data and local regulatory guidance continues to evolve. For instance, in the UK, the adoption of the Data Use and Access Act may require more localized data storage facilities and could impact how we segregate personal data between markets. There also continues to be a growing trend of other countries adopting similar laws which we will have to assess and understand in order to implement required changes. 

Additionally, both the GDPR and the California Consumer Privacy Act of 2018 (the CCPA) are continuously evolving and developing and may be interpreted and applied differently from jurisdiction to jurisdiction and may create inconsistent or conflicting requirements. For example, the California Privacy Rights Act (the CPRA) modifies the CCPA significantly, further enhancing and extending an individual’s rights over their personal data and the obligations placed on companies that handle this data. The resulting new regulations became effective on January 1, 2023. Most notably, employee and business data were brought into scope, which raises the compliance requirements for us significantly, in terms of internal