Company: TEAM
Filing Date: 2025-10-31
Form Type: 10-Q
Source: 0001650372-25-000068
Chunk: 300

Company: Atlassian Corp
Filing Date: 2025-10-31
Form: 10-Q
Item: Part I, Item 8
Chunk 300
---
 increased scrutiny among customers, particularly in the public sector and highly regulated industries, and may be perceived differently from customer to customer. These developments could reduce demand for our services, require us to take on more onerous obligations in our contracts, restrict our ability to store, transfer and process data, require us to fundamentally change our business activities and practices or modify our products, or, in some cases, impact our ability or our customers' ability to offer our services in certain locations, to deploy our solutions, to reach current and prospective customers, or to derive insights from customer data globally. For example, in July 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S. Privacy Shield Framework, one of the mechanisms that allowed companies, including Atlassian, to transfer personal data from the EEA to the United States. Even though the CJEU decision upheld the Standard Contractual Clauses as an adequate transfer mechanism, the decision created uncertainty around the validity of all EU-to-U.S. data transfers. The EU and U.S. governments later established the EU-U.S. Data Privacy Framework to foster EU-to-U.S. data transfers and address the concerns raised in the aforementioned CJEU decision, but it is uncertain whether this framework will eventually be overturned in court like the previous two EU-U.S. bilateral cross-border transfer frameworks. The validity of the EU-U.S. Data Privacy Framework recently survived a legal challenge in September 2025 before the CJEU but this outcome does not preclude future successful challenges on other grounds. Certain countries outside of the EEA have also passed or are considering passing laws requiring varying degrees of local data residency. By way of further example, statutory damages available through a private right of action for certain data breaches under the CPRA and potentially other U.S. states’ laws may increase our and our customers’ potential liability and the demands our customers place on us. As another example, jurisdictions are considering legal frameworks on AI, which is a trend that may increase now that the first such framework has entered into force in the EU; several others have been passed in various jurisdictions.

The costs of compliance with, and other burdens imposed by, privacy laws, regulations and standards may limit the use and adoption of our services, reduce overall demand for our services, make it more difficult to meet expectations from our commitments to customers and our customers’ users, lead to significant fines, penalties or liabilities for noncompliance, impact our reputation, or slow the pace at which we close sales transactions, in particular