Privacy and data rules
173 of 521 companies added a paragraph in Risk Factors that uses one of these words:
privacy, GDPR, personal data, personal information.
The paragraph is in the latest 10-K and nothing like it was in the one before.
It counts text; it does not say how serious a risk is. Words in capitals only (such as AI) must be in capitals.
By sector
Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.
| Sector | Companies | Compared |
|---|---|---|
| Orthopedic, Prosthetic & Surgical Appliances & Supplies | 5 | 5 |
| Computer Peripheral Equipment, NEC | 2 | 2 |
| Instruments For Meas & Testing of Electricity & Elec Signals | 2 | 2 |
| Men's & Boys' Furnishgs, Work Clothg, & Allied Garments | 2 | 2 |
| Rubber & Plastics Footwear | 2 | 2 |
| Air Courier Services | 1 | 1 |
| Apparel & Other Finishd Prods of Fabrics & Similar Matl | 1 | 1 |
| Bottled & Canned Soft Drinks & Carbonated Waters | 1 | 1 |
| Electronic Components & Accessories | 1 | 1 |
| Electronic Connectors | 1 | 1 |
| Engines & Turbines | 1 | 1 |
| Gas & Other Services Combined | 1 | 1 |
| General Industrial Machinery & Equipment, NEC | 1 | 1 |
| Grain Mill Products | 1 | 1 |
| Leather & Leather Products | 1 | 1 |
| Meat Packing Plants | 1 | 1 |
| Misc Industrial & Commercial Machinery & Equipment | 1 | 1 |
| Miscellaneous Food Preparations & Kindred Products | 1 | 1 |
| Oil & Gas Field Machinery & Equipment | 1 | 1 |
| Paints, Varnishes, Lacquers, Enamels & Allied Prods | 1 | 1 |
| Paper Mills | 1 | 1 |
| Radiotelephone Communications | 1 | 1 |
| Real Estate | 1 | 1 |
| Retail-Drug Stores and Proprietary Stores | 1 | 1 |
| Retail-Eating & Drinking Places | 1 | 1 |
| Retail-Radio, Tv & Consumer Electronics Stores | 1 | 1 |
| Retail-Retail Stores, NEC | 1 | 1 |
| Rolling Drawing & Extruding of Nonferrous Metals | 1 | 1 |
| Services-Advertising Agencies | 1 | 1 |
| Services-Detective, Guard & Armored Car Services | 1 | 1 |
| Services-Equipment Rental & Leasing, NEC | 1 | 1 |
| Services-Miscellaneous Amusement & Recreation | 1 | 1 |
| Services-Video Tape Rental | 1 | 1 |
| Special Industry Machinery, NEC | 1 | 1 |
| Water Supply | 1 | 1 |
| Wholesale-Medical, Dental & Hospital Equipment & Supplies | 1 | 1 |
| Computer Communications Equipment | 2 | 3 |
| Electronic Computers | 2 | 3 |
| Measuring & Controlling Devices, NEC | 2 | 3 |
| Retail-Auto Dealers & Gasoline Stations | 2 | 3 |
| Services-Commercial Physical & Biological Research | 2 | 3 |
| Services-Computer Integrated Systems Design | 2 | 3 |
| Services-Consumer Credit Reporting, Collection Agencies | 2 | 3 |
| Services-Prepackaged Software | 12 | 19 |
| Finance Services | 17 | 28 |
| Biological Products, (No Diagnostic Substances) | 3 | 5 |
| Computer Storage Devices | 3 | 5 |
| Industrial Instruments For Measurement, Display, and Control | 3 | 5 |
| Electronic & Other Electrical Equipment (No Computer Equip) | 2 | 4 |
| Retail-Eating Places | 2 | 4 |
| Services-Computer Processing & Data Preparation | 2 | 4 |
| Accident & Health Insurance | 1 | 2 |
| Cigarettes | 1 | 2 |
| Cutlery, Handtools & General Hardware | 1 | 2 |
| Industrial Organic Chemicals | 1 | 2 |
| Mining & Quarrying of Nonmetallic Minerals (No Fuels) | 1 | 2 |
| Paperboard Containers & Boxes | 1 | 2 |
| Printed Circuit Boards | 1 | 2 |
| Radio & Tv Broadcasting & Communications Equipment | 1 | 2 |
| Retail-Auto & Home Supply Stores | 1 | 2 |
| Services-Medical Laboratories | 1 | 2 |
| Services-To Dwellings & Other Buildings | 1 | 2 |
| Telephone Communications (No Radiotelephone) | 1 | 2 |
| Transportation Services | 1 | 2 |
| Trucking (No Local) | 1 | 2 |
| Wholesale-Groceries & Related Products | 1 | 2 |
| Services-Computer Programming, Data Processing, Etc. | 2 | 5 |
| Services-Business Services, NEC | 6 | 16 |
| Investment Advice | 3 | 8 |
| National Commercial Banks | 4 | 11 |
| Real Estate Investment Trusts | 9 | 27 |
| Insurance Agents, Brokers & Service | 2 | 6 |
| Air-Cond & Warm Air Heatg Equip & Comm & Indl Refrig Equip | 1 | 3 |
| Computer & office Equipment | 1 | 3 |
| Life Insurance | 1 | 3 |
| Perfumes, Cosmetics & Other Toilet Preparations | 1 | 3 |
| Retail-Building Materials, Hardware, Garden Supply | 1 | 3 |
| Soap, Detergents, Cleang Preparations, Perfumes, Cosmetics | 1 | 3 |
| Surgical & Medical Instruments & Apparatus | 3 | 10 |
| Security Brokers, Dealers & Flotation Companies | 2 | 7 |
| Semiconductors & Related Devices | 4 | 15 |
| Search, Detection, Navigation, Guidance, Aeronautical Sys | 1 | 4 |
| Security & Commodity Brokers, Dealers, Exchanges & Services | 1 | 4 |
| Hospital & Medical Service Plans | 1 | 5 |
| Hotels & Motels | 1 | 5 |
| Laboratory Analytical Instruments | 1 | 5 |
| Retail-Variety Stores | 1 | 5 |
| Pharmaceutical Preparations | 2 | 11 |
| Fire, Marine & Casualty Insurance | 2 | 12 |
| Petroleum Refining | 1 | 6 |
| State Commercial Banks | 1 | 6 |
| Crude Petroleum & Natural Gas | 1 | 7 |
| Electric Services | 2 | 15 |
432 paragraphs · Investment Advice show all sectors
Following Brexit, the provisions of the GDPR were incorporated directly into U.K. law as the U.K. GDPR. In June 2025, the U.K. government enacted the Data (Use and Access) Act 2025, which includes reforms that may increase divergence between the U.K. and EU data protection regimes over time. In addition, the EU continues to pursue a broad digital regulatory agenda, including proposals to amend certain existing digital frameworks. These developments may require us and our portfolio companies to update policies, procedures, technical and organizational measures, vendor arrangements, cross-border data
Read in the 10-K filed Feb 25, 2026 ↗
In December 2025, the European Commission renewed its adequacy decisions for the U.K., which permit the transfer of personal data from the EEA to the U.K., until December 27, 2031, subject to periodic review and potential renewal. While we currently rely on the adequacy decisions and other transfer mechanisms, the adequacy decisions could be modified, suspended or withdrawn in the future, which could require us and our portfolio companies to implement additional data transfer mechanisms and could increase costs and complexity.
Read in the 10-K filed Feb 25, 2026 ↗
We use and plan to expand our use of artificial intelligence tools and technologies in the operation of our business. These uses come with potential risks, including, but not limited to, generation of inaccurate results, misuse or disclosures of confidential information, infringement of third-party intellectual property rights, potential cybersecurity vulnerabilities, reputational risk and regulatory burdens. In addition, artificial intelligence models may create outputs that are flawed, inaccurate, biased, or that infringe or misappropriate intellectual property of third parties. The models may also be subject to new or different modes of cyber attacks, including prompt injection attacks, and such attacks may be able to circumvent cybersecurity tools and processes that we or the providers of such tools have in place. To the extent we rely on such technologies, these risks could negatively impact our business. There is also a risk that artificial intelligence tools or applications may be misused by our employees and/or third parties engaged by us. For example, an employee may input confidential information, including material non-public information, trade secrets, or personal information, into artificial intelligence technologies in a manner that results in such information becoming part of a dataset that is accessible by third-party artificial intelligence applications and users, including our competitors. Further, we may not be able to control how any third-party artificial intelligence technologies that we use are developed or maintained, or how data we input is used or disclosed, even where we have contractual protections with respect to these matters. The misuse or misappropriation of our data could have an adverse impact on our reputation and could subject us to legal and regulatory investigations and/or actions.
Read in the 10-K filed Feb 25, 2026 ↗
resources to compliance. A failure to comply with applicable Privacy Laws could result in fines, sanctions, enforcement actions or other penalties or reputational damage.
Read in the 10-K filed Feb 25, 2026 ↗
Cybersecurity, privacy and data protection have become top priorities for regulators in the United States and around the world. Many jurisdictions in which we operate have laws and regulations relating to privacy, data protection and cybersecurity, including the Gramm-Leach-Bliley Act (“GLBA”) (including recent amendments to Regulation S-P),
Read in the 10-K filed Feb 27, 2026 ↗
intelligence. See also “—Risks Related to Regulatory Matters—Privacy, data protection, cybersecurity and artificial intelligence
Read in the 10-K filed Feb 27, 2026 ↗
proprietary, sensitive and otherwise confidential information, including personal information of our investors, insurance
Read in the 10-K filed Feb 27, 2026 ↗
perceived inability, by us to adequately address privacy concerns, or comply with applicable privacy laws, regulations, policies,
Read in the 10-K filed Feb 27, 2026 ↗
industry standards and guidance, related contractual obligations, or other privacy legal obligations, even if unfounded, could
Read in the 10-K filed Feb 27, 2026 ↗
Privacy, data protection, cybersecurity and artificial intelligence laws may increase compliance costs
Read in the 10-K filed Feb 27, 2026 ↗
Data privacy, data protection and cybersecurity have become priorities for regulators around the world, and rapidly
Read in the 10-K filed Feb 27, 2026 ↗
federal and state privacy and data protection laws and regulations. For example, the California Consumer Privacy Act provides
Read in the 10-K filed Feb 27, 2026 ↗
violations. Other U.S. states have passed their own consumer privacy laws and other states are considering doing so. At the
Read in the 10-K filed Feb 27, 2026 ↗
S-P, which governs privacy notices and the safeguarding and disposal of customer information and establishes certain incident
Read in the 10-K filed Feb 27, 2026 ↗
Our insurance business processes sensitive personal information of policyholders, which exposes it to heightened privacy
Read in the 10-K filed Feb 27, 2026 ↗
We are also subject to non-U.S. privacy and data protection laws, including the European General Data Protection
Read in the 10-K filed Feb 27, 2026 ↗
Regulation, the Personal Information Protection Law of the People’s Republic of China, the India Digital Personal Data
Read in the 10-K filed Feb 27, 2026 ↗
us, our portfolio companies, or third-party service providers. In addition, we are often subject to privacy and data security
Read in the 10-K filed Feb 27, 2026 ↗
Failure to comply with applicable data privacy, data protection, cybersecurity, or artificial intelligence laws or related
Read in the 10-K filed Feb 27, 2026 ↗
relating to data privacy and cybersecurity matters have increased in recent years, and any significant enforcement action,
Read in the 10-K filed Feb 27, 2026 ↗