Company: IOT
Filing Date: 2025-03-25
Form Type: 10-K
Source: 0001642896-25-000022
Chunk: 74

Company: Samsara Inc.
Filing Date: 2025-03-25
Form: 10-K
Item: Item 1A
Chunk 74
---
). The United Kingdom also has adopted, in addition to the UK Extension to the EU-U.S. Data Privacy Framework, new data transfer mechanisms (namely, the UK International Data Transfer Agreement and the UK international data transfer addendum to the SCCs) addressing the cross-border transfer of personal data outside the United Kingdom that became effective as of March 21, 2022, and which are required to be implemented as necessary. While the EU has deemed the United Kingdom to be an “adequate country” to which personal data could be exported from the EEA, this decision is required to be renewed after four years of being in effect and may be modified, revoked, or challenged in the interim. The United Kingdom has also introduced legislation that would provide for significant modifications to its data protection regime. It is unclear how United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the United Kingdom will be regulated. Further, some jurisdictions and/or particular sectors also are considering or have enacted regulations or standards requiring local storage and processing of data that could increase the cost and complexity of delivering our services.

In light of these and other developments, we may, in addition to other impacts, experience additional costs associated with increased compliance burdens and be required to engage in new contract negotiations with third parties that aid in processing personal data on our behalf or localize certain personal data, and we may be required to implement additional contractual and technical safeguards for the lawful transfer of personal data. We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the relevant countries and/or geographic areas (e.g., the EEA, Switzerland, and the United Kingdom), and may experience hesitancy, reluctance, or refusal by customers to use our solution due to the potential risk exposure to such customers as a result of sentiment, e.g., within the EEA, Switzerland, and the United Kingdom regarding international data transfers and data protection obligations imposed on them. Failure to comply with the relevant laws and regulations like the GDPR could result in penalties for noncompliance (including possible fines e.g., up to the greater of €20 million and 4% of our global annual turnover for the preceding financial year for the most serious violations under the GDPR, as well as the right to compensation for financial or non-financial damages claimed by individuals under Article 82 of the GDPR).

In addition to the GDPR, the European Commission has another draft regulation in the approval process that focuses on a person’s right to conduct a private life. The