Privacy and data rules

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

432 paragraphs · Services-Prepackaged Software show all sectors

We may be subject to certain aspects of the EU’s Digital Services Act, which imposes additional legal requirements on certain types of digital service providers, including online platforms and content sharing sites. Moreover, some of our customers are subject to the EU’s Digital Operational Resilience Act and similar UK regulatory requirements on operational resilience. There may be certain aspects of the EU’s Data Act that could apply to certain types of cloud services providers and require them to facilitate data portability (e.g., switching between services), as well as certain requirements concerning cross border international transfers of, and governmental access to, non-personal information outside of the European Economic Area. Further, the U.S. Department of Justice issued a rule entitled Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which placed additional restriction on certain data transactions involving countries of concern and covered individuals that may impact certain business activities, and has impacted the transfer of data in connection with certain transactions.

Read in the 10-K filed Jan 15, 2026 ↗

Our strategy to digitize Autodesk involves increasing our use of cloud- and web-based technologies and applications to leverage customer data to improve our offerings for the benefit of our customers. To accomplish this strategy, we must collect and otherwise process customer data, which may include personal data and personal information of users from different jurisdictions globally. We also collect and otherwise process personal data and personal information of our employees and contractors. As a result, numerous federal, state, and global laws and regulations relating to privacy, data protection, cybersecurity, and the collection, use, security, and other processing of personal data, personal information, and other data and information, apply to our data and information processing activities. The scope of these laws and regulations is rapidly

Read in the 10-K filed Mar 3, 2026 ↗

•Any actual or perceived failure to comply with new or existing laws, regulations and other requirements relating to the privacy, security, processing and cross-border transfer of Personal Information (as defined below) could adversely affect our business, financial condition and results of operations.

Read in the 10-K filed Feb 19, 2026 ↗

Any actual or perceived failure to comply with new or existing laws, regulations and other requirements relating to the privacy, security, processing and cross-border transfer of Personal Information could adversely affect our business, financial condition and results of operations.

Read in the 10-K filed Feb 19, 2026 ↗

In connection with running our business, we receive, store, use and otherwise process Personal Information, including from and about actual and prospective customers and users, as well as our employees and business contacts. We are therefore subject to a variety of federal, state and foreign laws, regulations and other requirements relating to the privacy, security and handling of Personal Information. For example, the EU/UK General Data Protection Regulation, the California Consumer Privacy Act and related laws in other jurisdictions require us to adhere to certain disclosure restrictions and deletion obligations with respect to the Personal Information of their residents, and allow for penalties for violations and, in some cases, a private right of action. These laws also impose transparency and other obligations with respect to Personal Information of their respective residents and provide residents with similar rights with respect to their Personal Information. We have invested, and continue to invest, human and technology resources in our efforts to comply with such requirements that may be time-intensive and costly.

Read in the 10-K filed Feb 19, 2026 ↗

The application and interpretation of such requirements are constantly evolving and are subject to change, creating a complex compliance environment. In some cases, these requirements may be either unclear in their interpretation and application, or they may have inconsistent or conflicting requirements with each other. Further, there has been a substantial increase in legislative activity and regulatory focus on data privacy and security in the United States and elsewhere, including in relation to cybersecurity incidents. In addition, some such requirements place restrictions on our ability to process Personal Information across our business or across country borders.

Read in the 10-K filed Feb 19, 2026 ↗

It is possible that new laws, regulations and other requirements, or amendments to or changes in interpretations of existing laws, regulations and other requirements, may require us to incur significant costs, implement new processes or change our handling of information and business operations, which could ultimately hinder our ability to grow our business by extracting value from our data assets. In addition, any failure or perceived failure by us to comply with laws, regulations and other requirements relating to privacy, security and handling of information could result in legal claims or proceedings (including class actions), regulatory investigations or enforcement actions. We could incur significant costs in investigating and defending such claims and, if found liable, pay significant damages or fines or be required to make changes to our business. These proceedings and any subsequent adverse outcomes may subject us to significant negative publicity and an erosion of trust. If any of these events were to occur, our reputation, business, financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Feb 19, 2026 ↗

We are increasingly building AI into many of our offerings, including generative and agentic AI. As with many technical innovations, AI offerings, such as Agentforce, and our Agentforce 360 Platform present additional risks and challenges that could affect customer adoption and therefore our business. For example, the development and deployment of AI offerings, including those involving information regarding our customers’ customers, raise emerging ethical, legal and operational considerations. If we enable or offer solutions that draw controversy due to their perceived or actual impact on human rights, privacy, employment or other social concerns, we may experience new or heightened governmental or regulatory scrutiny, investigations, enforcement actions, fines or penalties and reputational or competitive harm.

Read in the 10-K filed Mar 2, 2026 ↗

AI technologies may produce content that is inaccurate, misleading, biased, offensive or unsafe, and may implicate privacy, security or intellectual property rights, including through the generation of copyrighted or other protected material. If our customers or others rely on such content to their detriment, or if regulators or rights holders assert claims relating to AI-generated content, we may be exposed to litigation, regulatory investigations, enforcement actions, indemnification obligations, monetary penalties or other liabilities, or reputational harm. Developing, testing and deploying AI technologies may also increase the cost profile of our offerings due to the computing costs required. If we are unable to effectively mitigate these risks, or if our mitigation efforts result in excessive costs, our reputation, business, operating results and financial condition may be adversely affected.

Read in the 10-K filed Mar 2, 2026 ↗

These laws continue to evolve and expand, including through the adoption of new comprehensive data protection regimes such as India’s Digital Personal Data Protection Act 2023, and through the introduction of additional implementing rules and regulations in various jurisdictions. As a result, we and our customers may become subject to additional regulatory burdens. New EU laws, including the DSA, the Data Act and the AI Act, have also been adopted and, depending on how they are implemented, interpreted and enforced, may impose additional rules, restrictions or compliance requirements on the development, deployment or use of our products and services, including AI-enabled features.

Read in the 10-K filed Mar 2, 2026 ↗

jurisdictions in which we operate, such procedures and controls may not be effective in ensuring compliance or preventing unauthorized transfers of personal data.

Read in the 10-K filed Mar 5, 2026 ↗

In addition, operating system and platform providers increasingly incorporate native security, privacy, and financial features into their products, often at no additional cost, which may reduce demand for our offerings or diminish their differentiation. We also depend on strategic distribution and bundling relationships, and partners have in the past replaced, and may in the future replace, our solutions with competing or internally developed offerings, promote competing products more favorably, or limit interoperability. Industry consolidation, vertical integration, and the introduction of new or alternative technologies may further intensify competition.

Read in the 10-K filed May 21, 2026 ↗

Issues in the development and deployment of AI, including generative AI and emerging AI-enabled cyber threats, could expose us to regulatory, privacy, IP, cybersecurity, operational and reputational risks.

Read in the 10-K filed May 21, 2026 ↗

In the operation of our business, particularly in relation to our identity and information protection service and financial wellness offerings, we collect, use, process, store, transmit or disclose (collectively, process) an increasingly large amount of confidential information, including personal information (which includes credit card information and other critical data) from

Read in the 10-K filed May 21, 2026 ↗

employees and customers in multiple jurisdictions. This information is subject to a rapidly evolving and increasingly complex framework of federal, state and foreign privacy, data protection and data security laws, as well as contractual obligations.

Read in the 10-K filed May 21, 2026 ↗

At the federal level, the Gramm-Leach-Bliley (the GLBA) (along with its implementing regulations) requires disclosures to consumers about our handling of their nonpublic personal information and provides consumers with certain rights to restrict information sharing. Additionally, our investment adviser and broker-dealer subsidiaries are subject to SEC Regulation S-P, which mandates policies and procedures designed to safeguard customer information.

Read in the 10-K filed May 21, 2026 ↗

At the state level, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA), and similar comprehensive privacy laws enacted in multiple other U.S. states, provide consumers with rights to access, correct, delete and restrict the use, sale or sharing of their personal information and impose disclosure, governance and data protection obligations on covered businesses. These state laws provide civil penalties for violations, as well as private rights of action for certain data breaches. Additional states continue to enact comprehensive privacy legislation, creating a fragmented and evolving compliance environment that increases operational complexity and costs.

Read in the 10-K filed May 21, 2026 ↗

From time to time, we are involved in litigation, investigations, examinations and other legal or administrative proceedings initiated by governmental agencies or private parties. These matters may involve, among other things, labor and employment, discrimination and harassment, commercial disputes, class actions, general contract and tort claims, defamation, data privacy rights, antitrust, fraud, securities (including “blue sky” laws) violations, consumer protection laws, and other regulatory or

Read in the 10-K filed May 21, 2026 ↗

manner inconsistent with our responsible AI policies and practices. These outcomes may give rise to public controversy, societal concerns, or regulatory actions relating to human rights, privacy, employment, or other social, economic, or political issues, and could adversely affect our reputation, competitive position, business, financial condition, and results of operations.

Read in the 10-K filed Jul 29, 2026 ↗

•introduction of additional compliance obligations or new risks, including with respect to increased privacy and data collection concerns, content moderation and censorship, and system outages;

Read in the 10-K filed Jun 22, 2026 ↗

The AI regulatory landscape is evolving, and we may be required to dedicate additional operational and financial resources to ensure compliance with new legal requirements. For instance, the European Union ("E.U.") Artificial Intelligence Act entered into force in August 2024, with some provisions becoming enforceable between February 2025 and August 2027, subject to a likely delay of the Act's high-risk enforcement until December 2027. In the U.S., some states have enacted general purpose AI laws, while others have enacted use-case specific AI laws; other states may enact similar laws in the future, which will add complexity to our compliance efforts. This uncertainty may require additional investments in oversight and the development of protections and safeguards to ensure compliance, including to the extent any personal information is processed by such technologies.

Read in the 10-K filed May 22, 2026 ↗

or when. Any such new or amended privacy laws may add complexity to our compliance efforts and require us to expend additional financial or other resources as a result.

Read in the 10-K filed May 22, 2026 ↗

In the normal course of business, we experience, and have experienced, cyberattacks and other security incidents, which have in the past and may in the future cause harm to our business. For example, in 2022, one such incident resulted in threat actors obtaining employee credentials and accessing customer data, and required us to notify affected customers and regulators and take steps to remediate the incident. While to date the security events we have experienced have not had a material financial impact, we may experience significant and material future incidents. Any security incident can result in loss, corruption, unavailability, or other unauthorized processing of confidential information or sensitive personal information. Any such event, or the perception that it has occurred, may also result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigation, fines, penalties, and other consequences and liabilities that could adversely affect our business, results of operation and financial condition. Laws and regulations require us to maintain security measures, and we may have contractual or other legal obligations to notify customers, government agencies, impacted individuals or other relevant stakeholders of security breaches or other incidents, which disclosures are costly and may cause widespread negative publicity and resulting harm, among other adverse consequences. Further, the detection, prevention, and remediation of known and potential security incidents, including determining whether an incident is notifiable or reportable, may not be straightforward and result in additional direct or indirect costs to respond or alleviate the consequences of the actual or perceived incident, such as additional infrastructure capacity spending to mitigate system degradation or reallocation of resources from development activities. We maintain errors, omissions and cyber liability insurance policies covering certain security and privacy damages, but such insurance may not be sufficient to cover the potentially significant losses resulting from a security breach or other incident, may be denied with respect to a particular claim, or may not remain available in the future on acceptable terms or at all.

Read in the 10-K filed Feb 24, 2026 ↗

We are subject to increasing legal, regulatory, and contractual obligations relating to privacy, data protection and cybersecurity that affect how we process personal data in the jurisdictions where we and our customers operate. Our obligations change frequently due to new or modified laws and regulations, as well as court rulings interpreting or invalidating them. These evolving obligations involve significant compliance costs and operational challenges, and increasingly expose us to enforcement actions and other proceedings or actions, sanctions, and litigation, as well as regulatory and public scrutiny of our practices relating to personal information. We expect the increasing breadth and depth, and changing nature of, these obligations to continue to require significant resources, including to review our technology, systems and processes against changing requirements. They may also limit our ability to use personal data for new products, including those relying on AI-related technologies.

Read in the 10-K filed Feb 24, 2026 ↗

In the United States, for example, the California Consumer Privacy Act (as amended by the California Privacy Rights Act of 2020, the “CCPA”) provides our customers, employees, and other individuals certain rights related to their personal information. The federal government has also proposed, and numerous other states are considering or have proposed and/or enacted, laws and regulations addressing privacy and cybersecurity. Internationally, the regulatory landscape is increasingly complex and fragmented and compliance increasingly financially burdensome. For example, in the European Union (“EU”), the General Data Protection Regulation (“GDPR”) imposes significant requirements regarding the processing of personal information, including related to transparency, individuals’ privacy rights, compliance contracting, data minimization, data breach notification, data retention, security, and international data transfers. Other international privacy and data protection laws also impose strict requirements, such as related to marketing communications and deployment of cookies. Together, this patchwork of global requirements presents significant compliance challenges, and subjects us to possible fines, sanctions, litigation, and other adverse consequences. For example, under the GDPR, regulators may impose temporary or definitive bans on data transfers or other processing, require deletion, and impose significant fines, potentially ranging up to 4% of our worldwide revenue.

Read in the 10-K filed Feb 24, 2026 ↗

Additionally, as a provider of interconnected VoIP service, we must also comply with certain U.S. federal privacy laws and regulations, including Section 222 of the Communications Act of 1934, as amended, and the FCC’s customer proprietary network information rules. We are also subject to state rules and obligations that have been proposed or adopted, or may be in the future. We are also subject to other rapidly changing technology- and industry-specific laws, regulations and obligations. For example, we expect increased global regulation in the use of AI and ML such as the recent AI Act in Europe, which imposes onerous obligations related to the development, placement on the market and use of AI systems. Various countries and a growing number of U.S. states are also enacting legislation regulating aspects of AI or AI generally. We may need to change our business practices to comply with obligations under these or other new and evolving regimes, and face significant compliance challenges, liability, or other risks.

Read in the 10-K filed Feb 24, 2026 ↗

As a provider of communications products and a licensed telecommunications provider, we are required to comply with many changing federal, state and international regulations, including relating to privacy, security, telecommunications, consumer protection, fraud and scam prevention, Know Your Customer and Know Your Traffic and other requirements and obligations, which often vary across the numerous jurisdictions in which we operate. Compliance with these requirements involves significant management attention and compliance costs, and can present operational challenges, onboarding delays and friction for our customers, require us to raise prices, restructure or discontinue our products, or limit our ability to expand into certain jurisdictions. If we do not comply with such requirements, we could face enforcement actions, significant fines, remedial directions to implement audits or new processes, loss of licenses, restrictions or prohibitions on our ability to operate or offer certain of our products, eroded customer trust, and damage to our brand and reputation, and other consequences. Any of the foregoing could adversely affect our business, results of operations and financial condition.

Read in the 10-K filed Feb 24, 2026 ↗

In the United States, at the federal level, we and/or our customers are required to comply with laws and regulations limiting telemarketing and certain technologies that enable automatic calling and/or messaging and establishing quiet hours for solicitations, such as the Telephone Consumer Protection Act of 1991 (“TCPA”), laws requiring assistance to law enforcement in electronic surveillance, requirements to pay regulatory fees and contributions to various federally administered funds, requirements to safeguard the privacy of certain customer information, and requirements aimed at mitigating illegal robocalls and robotexts, such as the implementation of call authentication technologies, and other compliance requirements. At the state level, some states have adopted, proposed or may propose, regulations that may subject us to additional registration, reporting, resiliency and/or compliance obligations, including laws similar to the TCPA.

Read in the 10-K filed Feb 24, 2026 ↗

We process personal data on behalf of our customers, who use our solutions to manage personal data of their employees, healthcare professionals, patients, and related individuals. We also process personal data as part of the Veeva Data Cloud offerings, which provide our customers with professionally relevant data related to healthcare providers and other industry professionals and stakeholders. In addition, we process personal data to provide services that allow healthcare marketers to reach their target audiences and to measure the impact of their media campaigns. In some cases, the personal data that we process includes sensitive personal data, such as health data.

Read in the 10-K filed Mar 20, 2026 ↗

Many countries and governmental bodies have adopted or may adopt laws and regulations governing our processing of personal and other data, making compliance an increasingly complex task. For example, we are regulated under the European General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s General Data Protection Regulation (“UK GDPR”), as amended by the Data (Use and Access) Act of 2025, where we act as a data controller for our data products and a data processor with respect to our software products. In China, we are regulated under China’s Personal Information Protection Law (“PIPL”), where we process data as an entrusted party on behalf of our customers who operate as data handlers. In certain cases, we are regulated under the U.S. Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) that covers protected health information collected or maintained by covered entities and their business associates. Additionally, many states in the U.S. have passed comprehensive privacy legislation, such as the California Consumer Privacy Act (amended by the California Privacy Rights Act). Some states in the U.S. also have passed legislation governing the processing of particular types of data, such as biometric data and certain other health-related data.

Read in the 10-K filed Mar 20, 2026 ↗

These laws and regulations impose data subject notice or transparency requirements, mandated privacy and security standards, and registration obligations. They also grant rights to data subjects, such as allowing them to access, correct, delete, or opt out of the sale or sharing of their information. Some of these laws and regulations target certain types of marketing and advertising based on the use of personal information. For example, in response to the State of Washington’s My Health My Data Act, which placed significant restrictions on how businesses can collect, use, and disclose consumer health data, we added limitations to the audience segments on our Veeva Crossix data platform. Other states have considered, and in certain cases, enacted, similar laws.

Read in the 10-K filed Mar 20, 2026 ↗

In 2025, the U.S. Department of Justice issued a final rule that places limitations, and in some cases prohibitions, on certain transfers of and access to certain personal data of U.S. persons by persons and entities located in China (and other designated countries) or controlled by a person or entity located in China (and other designated

Read in the 10-K filed Mar 20, 2026 ↗

As we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations. In addition to our own processing of personal data, our customers expect that our solutions can be used to enable their compliance with applicable data protection, data privacy, and cybersecurity laws and regulations.

Read in the 10-K filed Mar 20, 2026 ↗

Consumer and societal attitudes toward AI are evolving and there is a risk that customers, regulators or the public may perceive AI technologies negatively. Concerns about automation, privacy, security, bias, transparency, flawed datasets, or other ethical considerations could reduce trust in our products and services or deter customer adoption of AI-enabled features in our products or services. Our customers and sellers may become increasingly reliant on AI outputs in our products and services when making financial or operational decisions. AI-enabled features in our products may generate outputs that could be interpreted as regulated advice, even if unintended or automated. If such AI outputs are, or are perceived to be, inaccurate, biased, flawed, or otherwise determined as providing regulated advice without appropriate authorization, we could face reputational harm, regulatory scrutiny, enforcement actions or liability claims, any of which could materially and adversely affect our business, financial condition, and results of operations.

Read in the 10-K filed Feb 26, 2026 ↗