Privacy and data rules
173 of 521 companies added a paragraph in Risk Factors that uses one of these words:
privacy, GDPR, personal data, personal information.
The paragraph is in the latest 10-K and nothing like it was in the one before.
It counts text; it does not say how serious a risk is. Words in capitals only (such as AI) must be in capitals.
By sector
Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.
| Sector | Companies | Compared |
|---|---|---|
| Orthopedic, Prosthetic & Surgical Appliances & Supplies | 5 | 5 |
| Computer Peripheral Equipment, NEC | 2 | 2 |
| Instruments For Meas & Testing of Electricity & Elec Signals | 2 | 2 |
| Men's & Boys' Furnishgs, Work Clothg, & Allied Garments | 2 | 2 |
| Rubber & Plastics Footwear | 2 | 2 |
| Air Courier Services | 1 | 1 |
| Apparel & Other Finishd Prods of Fabrics & Similar Matl | 1 | 1 |
| Bottled & Canned Soft Drinks & Carbonated Waters | 1 | 1 |
| Electronic Components & Accessories | 1 | 1 |
| Electronic Connectors | 1 | 1 |
| Engines & Turbines | 1 | 1 |
| Gas & Other Services Combined | 1 | 1 |
| General Industrial Machinery & Equipment, NEC | 1 | 1 |
| Grain Mill Products | 1 | 1 |
| Leather & Leather Products | 1 | 1 |
| Meat Packing Plants | 1 | 1 |
| Misc Industrial & Commercial Machinery & Equipment | 1 | 1 |
| Miscellaneous Food Preparations & Kindred Products | 1 | 1 |
| Oil & Gas Field Machinery & Equipment | 1 | 1 |
| Paints, Varnishes, Lacquers, Enamels & Allied Prods | 1 | 1 |
| Paper Mills | 1 | 1 |
| Radiotelephone Communications | 1 | 1 |
| Real Estate | 1 | 1 |
| Retail-Drug Stores and Proprietary Stores | 1 | 1 |
| Retail-Eating & Drinking Places | 1 | 1 |
| Retail-Radio, Tv & Consumer Electronics Stores | 1 | 1 |
| Retail-Retail Stores, NEC | 1 | 1 |
| Rolling Drawing & Extruding of Nonferrous Metals | 1 | 1 |
| Services-Advertising Agencies | 1 | 1 |
| Services-Detective, Guard & Armored Car Services | 1 | 1 |
| Services-Equipment Rental & Leasing, NEC | 1 | 1 |
| Services-Miscellaneous Amusement & Recreation | 1 | 1 |
| Services-Video Tape Rental | 1 | 1 |
| Special Industry Machinery, NEC | 1 | 1 |
| Water Supply | 1 | 1 |
| Wholesale-Medical, Dental & Hospital Equipment & Supplies | 1 | 1 |
| Computer Communications Equipment | 2 | 3 |
| Electronic Computers | 2 | 3 |
| Measuring & Controlling Devices, NEC | 2 | 3 |
| Retail-Auto Dealers & Gasoline Stations | 2 | 3 |
| Services-Commercial Physical & Biological Research | 2 | 3 |
| Services-Computer Integrated Systems Design | 2 | 3 |
| Services-Consumer Credit Reporting, Collection Agencies | 2 | 3 |
| Services-Prepackaged Software | 12 | 19 |
| Finance Services | 17 | 28 |
| Biological Products, (No Diagnostic Substances) | 3 | 5 |
| Computer Storage Devices | 3 | 5 |
| Industrial Instruments For Measurement, Display, and Control | 3 | 5 |
| Electronic & Other Electrical Equipment (No Computer Equip) | 2 | 4 |
| Retail-Eating Places | 2 | 4 |
| Services-Computer Processing & Data Preparation | 2 | 4 |
| Accident & Health Insurance | 1 | 2 |
| Cigarettes | 1 | 2 |
| Cutlery, Handtools & General Hardware | 1 | 2 |
| Industrial Organic Chemicals | 1 | 2 |
| Mining & Quarrying of Nonmetallic Minerals (No Fuels) | 1 | 2 |
| Paperboard Containers & Boxes | 1 | 2 |
| Printed Circuit Boards | 1 | 2 |
| Radio & Tv Broadcasting & Communications Equipment | 1 | 2 |
| Retail-Auto & Home Supply Stores | 1 | 2 |
| Services-Medical Laboratories | 1 | 2 |
| Services-To Dwellings & Other Buildings | 1 | 2 |
| Telephone Communications (No Radiotelephone) | 1 | 2 |
| Transportation Services | 1 | 2 |
| Trucking (No Local) | 1 | 2 |
| Wholesale-Groceries & Related Products | 1 | 2 |
| Services-Computer Programming, Data Processing, Etc. | 2 | 5 |
| Services-Business Services, NEC | 6 | 16 |
| Investment Advice | 3 | 8 |
| National Commercial Banks | 4 | 11 |
| Real Estate Investment Trusts | 9 | 27 |
| Insurance Agents, Brokers & Service | 2 | 6 |
| Air-Cond & Warm Air Heatg Equip & Comm & Indl Refrig Equip | 1 | 3 |
| Computer & office Equipment | 1 | 3 |
| Life Insurance | 1 | 3 |
| Perfumes, Cosmetics & Other Toilet Preparations | 1 | 3 |
| Retail-Building Materials, Hardware, Garden Supply | 1 | 3 |
| Soap, Detergents, Cleang Preparations, Perfumes, Cosmetics | 1 | 3 |
| Surgical & Medical Instruments & Apparatus | 3 | 10 |
| Security Brokers, Dealers & Flotation Companies | 2 | 7 |
| Semiconductors & Related Devices | 4 | 15 |
| Search, Detection, Navigation, Guidance, Aeronautical Sys | 1 | 4 |
| Security & Commodity Brokers, Dealers, Exchanges & Services | 1 | 4 |
| Hospital & Medical Service Plans | 1 | 5 |
| Hotels & Motels | 1 | 5 |
| Laboratory Analytical Instruments | 1 | 5 |
| Retail-Variety Stores | 1 | 5 |
| Pharmaceutical Preparations | 2 | 11 |
| Fire, Marine & Casualty Insurance | 2 | 12 |
| Petroleum Refining | 1 | 6 |
| State Commercial Banks | 1 | 6 |
| Crude Petroleum & Natural Gas | 1 | 7 |
| Electric Services | 2 | 15 |
432 paragraphs · Services-Computer Processing & Data Preparation show all sectors
The collection, storage, hosting, transfer, processing, disclosure, use, security and retention and destruction of personal information required to provide our services is subject to federal, state and foreign privacy, data protection and cyber security laws. These laws, which are not uniform, generally do one or more of the following: regulate the collection, storage, hosting,
Read in the 10-K filed Aug 5, 2026 ↗
Regulatory developments in the U.S. present additional risks. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023. The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation. In addition, numerous states have enacted, or are considering, comprehensive privacy laws and other laws that touch on the processing of personal data in specific contexts, including in connection with artificial intelligence and automated systems, further contributing to a fragmented and evolving regulatory landscape that has and may continue to create compliance challenges.
Read in the 10-K filed Mar 6, 2026 ↗
Additionally, a final rule issued by the U.S. Department of Justice establishing a “Data Security Program” came into effect on April 8, 2025. The rule prohibits or restricts certain transactions that could result in access to bulk U.S. sensitive personal data or U.S. government-related data by countries of concern, including China (which includes Hong Kong and Macau). The rule imposes certain diligence, security, audit and record-keeping requirements, and may adversely impact certain of our global business operations, including by restricting or conditioning certain data access or transfers involving subsidiaries, affiliates, and vendors.
Read in the 10-K filed Mar 6, 2026 ↗
In addition, as AI technologies are increasingly used across the industry, including in connection with data analytics, automation, customer service, and decision-support features, the speed, scale, and complexity of data processing may increase, which may heighten data privacy risks. AI-enabled or agentic AI features may be targeted, misused, or produce outputs or inferences that implicate personal data in ways that are difficult to anticipate or control, potentially resulting in regulatory scrutiny, litigation, or reputational harm, even in the absence of a data breach.
Read in the 10-K filed Mar 6, 2026 ↗