Company: NCNO
Filing Date: 2025-04-01
Form Type: 10-K
Source: 0001902733-25-000026
Chunk: 87

Company: nCino, Inc.
Filing Date: 2025-04-01
Form: 10-K
Item: Item 1A
Chunk 87
---
 bridge. Personal data may now be transferred from the UK under the UK-U.S. data bridge through the UK extension to the DPF to organizations self-certified under the UK extension to DPF. This may have implications for our cross-border data flows and may result in additional compliance costs.

15

Data protection supervisory authorities have the power under the GDPR to (amongst other things) impose fines of up to €20 million (under the EU GDPR) or £17.5 million (under the UK GDPR) or up to 4% of the annual global revenue of the noncompliant company, whichever is greater, for serious violations of certain of the GDPR’s requirements. Data subjects also have a right to compensation, as a result of an organization's breach of the GDPR which has affected them for financial or non-financial losses (e.g., distress). Complying with the GDPR may cause us to incur substantial operational and compliance costs or require us to change our business practices. Despite our efforts to bring practices into compliance with the GDPR, we may not be successful either due to internal or external factors such as resource allocation limitations or a lack of vendor cooperation. Non-compliance could result in proceedings against us by governmental entities, regulators, customers, data subjects, suppliers, vendors or other parties. Further, there is a risk that the measures will not be implemented correctly or that individuals within the business will not be fully compliant with the new procedures. If there are breaches of these measures, we could face significant administrative and monetary sanctions as well as reputational damage which may have a material adverse effect on our operations, financial condition and prospects.

From a cybersecurity perspective, the GDPR does not provide for a specific set of cybersecurity requirements or measures to be implemented but rather requires a controller or processor to implement appropriate cyber and data security measures in accordance with the then-current risk, the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. The GDPR however does explicitly require that controllers notify personal data breaches as described above.

On January 17, 2023, the EU Network and Information Systems Security 2 Directive (“NISD2”) entered into force. Member States had until October 17, 2024 to transpose NISD2 into EU Member State law. The European Commission initiated infringement procedures, by sending letters of formal notice to 23 Member States for failing to fully transpose NISD2 by this deadline. Under the NISD2, stringent cybersecurity and incident reporting requirements are imposed