Company: BBU
Filing Date: 2025-04-10
Form Type: 20-F
Source: 0001628280-25-017216
Chunk: 20

Company: Brookfield Business Partners L.P.
Filing Date: 2025-04-10
Form: 20-F
Item: Item 3
Chunk 20
---
 and preventing or ameliorating damage from a cyber incident.

Rapidly developing and changing global privacy laws and regulations could increase compliance costs and subject us to enforcement risks and reputational damage.

We are subject to various risks and costs associated with the collection, processing, storage and transmission of personally identifiable information and other sensitive and confidential information. This data is wide ranging and relates to our investors, employees, contractors and other counterparties and third parties. Our compliance obligations include those in laws and regulations in jurisdictions globally, including those relating to foreign data collection and privacy laws, including, for example, the General Data Protection Regulation in the European Union. Other countries where we operate are enacting or amending data protection, Artificial Intelligence and other technology laws to empower regulators to impose financial penalties and injunctions on certain data processing activities, which could have an adverse effect on our business. Global laws in this area are rapidly increasing in the scale and depth of their requirements, and are also often extra-territorial in nature. In addition, a wide range of regulators and private actors are seeking to enforce these laws across regions and borders. Furthermore, we frequently have privacy compliance requirements as a result of our contractual obligations with counterparties. These legal, regulatory and contractual obligations heighten our privacy obligations in the ordinary course of conducting our business in the U. S., Canada and internationally.

While we have taken various measures and made significant efforts and investment to ensure that our policies, processes and systems are both robust and compliant with these obligations, our potential liability remains, particularly given the continued and rapid development of privacy laws and regulations around the world, and increased criminal and civil enforcement actions and private litigation. Any inability, or perceived inability, by us to adequately address privacy concerns, or comply with applicable laws, regulations, policies, industry standards and guidance, contractual obligations or other legal obligations, even if unfounded, could result in significant regulatory and third party liability, increased costs, disruption of our business and operations, a loss of client (including investor) confidence and other reputational damage. Furthermore, as new privacy-related laws and regulations are implemented, the time and resources needed for us to comply with such laws and regulations continues to increase and become a significant compliance workstream.

Our failure to maintain effective internal controls could have a material adverse effect on our business in the future and the price of our units.

As a public company in the United States and Canada, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, and stock exchange rules