WDAYWorkday, Inc.

Following Over the EU’s passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, past five years, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations. As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm. For example, a new the EU-U.S. Data Privacy Framework (“DPF”) is in place under which EU data can legally be transferred to the United States. U.S. However, it is expected to face facing legal challenges. Until As legal challenges to the DPF make their way through the court system, remain unresolved, uncertainty may continue about regarding the legal requirements for transferring customer personal data to and from Europe, an integral process aspect of our business that remains governed by, and subject to, GDPR General Data Protection Regulation (“GDPR”) requirements. Failure to comply with the GDPR data processing requirements by either ourselves or our subcontractors subprocessors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers. Other new EU laws, including the EU Data Act, which primarily governs access to and use of non-personal data generated by digital services, have been, and may continue to be implemented, interpreted, and enforced in ways that impose additional rules and restrictions on the deployment, operation, or use of our products and services and may require us to adapt our business practices or contractual arrangements to comply with such requirements. Other countries such as Russia, China, Vietnam, and India have also passed or are in the process of passing laws imposing new requirements, including requirements related to consent and varying degrees of restrictive data residency requirements. Regulatory developments in the United States present additional risks. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023. The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation. Numerous states have enacted, or are considering, privacy laws as well, creating a patchwork of state laws that may create compliance challenges. Furthermore, the U.S. Congress is considering numerous privacy bills, and the U.S. Federal Trade Commission continues to fine companies for unfair or deceptive data protection practices and may undertake its own privacy rulemaking exercise. In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that customers may require us to adhere to and which may place additional burdens on us. Increasing sensitivity of individuals to unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate has and may continue to create a negative public reaction to technologies, products, and services such as ours or otherwise expose us to liability. localization.

We Recent macroeconomic events including increased tariffs, elevated inflation, and fluctuating interest rates and foreign currency exchange rates, as well as geopolitical instability, continue to impact the global economy and create uncertainty, volatility, and disruption of financial markets. As a result, we have experienced, and may continue to experience, a moderation of revenue growth rates due to deal scrutiny and the lengthening of certain sales cycles, particularly within net new opportunities, and as well as reduced growth in headcount level headcount-level commitments upon renewals of existing customers. The extended sales cycles are particularly evident in the government, higher education, and healthcare industries which are tied to federal funding. Further, we have provided, and may continue to provide, certain customers with more flexible payment terms. If the economic uncertainty continues, we may also experience additional negative impacts on customer renewals, customer collections, sales and marketing efforts, customer deployments, product development, or other financial metrics. Any of these factors could harm our business, financial condition, and operating results. For further discussion of the potential impacts of recent macroeconomic events on our business, financial condition, and operating results, see “Risk Factors” included in Part I, Item 1A of this report.

In December 2023, the FASB Financial Accounting Standards Board (“FASB”) issued ASU Accounting Standard Update (“ASU”) No. 2023-09, Income Taxes (Topic 740): Improvements to Income Disclosures, which requires disclosure of disaggregated income taxes paid, prescribes standard categories for the components of the effective tax rate reconciliation, and modifies other income tax-related disclosures. This We adopted this ASU is effective for fiscal years beginning after December 15, 2024, with early adoption permitted. The updated standard allows for adoption on a prospective basis, with a retrospective option. We do not intend to early adopt, and are currently evaluating the impacts of the updated standard. basis effective February 1, 2025. For further information, see Note 17, Income Taxes.