Company: CALX
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001406666-25-000045
Chunk: 103

Company: CALIX, INC
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 8
Chunk 103
---
 FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.

The General Data Protection Regulation, or EU GDPR, adopted by the European Union, or EU, and the UK General Data Protection Regulation, or UK GDPR, adopted by the United Kingdom, or UK, (the EU GDPR and UK GDPR hereinafter referred to as the GDPR) and national data protection supplementing laws in these jurisdictions impose specific duties and requirements upon companies that are subject to their provisions and collect, process or control personal data of individuals. Although we currently do not have material operations or business in the EU or the UK, we are in the process of expanding in these jurisdictions, and we have incurred and will continue to incur substantial costs in this respect. Furthermore, the GDPR imposes significant penalties for noncompliance which can amount to the greater of €20 million (for the EU GDPR) or £17.5 million (for the UK GDPR) or 4% of the total worldwide annual turnover of the preceding financial year; thus, any non-compliance with the GDPR could result in a material adverse effect on our business, financial condition and results of operations.

The EU GDPR and UK GDPR regulate cross-border transfers of personal data out of the European Economic Area, or the EEA, and the UK. There is currently legal complexity and uncertainty regarding international personal data transfers, and we expect this to continue. For example, there are number of decisions and proceedings in the EU where the legality of data transfers to China is being challenged. As the regulatory guidance and enforcement landscape in relation to data transfers further develops, our business, operations and financial condition could be adversely affected and we could suffer additional costs, complaints and/or regulatory investigations or fines. We may also have to stop using certain tools and vendors and make other operational changes. Further, our customers may not use our services in a manner that is compliant with applicable data privacy laws and regulations and our services may not be competitive in certain markets..  We may also become subject to new laws that regulate non-personal data. For example, the European Union’s Data Act imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, which may lead to the exercise of early termination rights. Depending on how this Act and any similar laws are implemented and interpreted, we may have to adapt our business practices,