Privacy and data rules

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

301 paragraphs · Services-Prepackaged Software show all sectors

In addition, the United Kingdom’s (“UK”) exit from the EU, and ongoing developments in the UK, have created uncertainty with regard to data protection regulation in the UK. Personal data processing in the UK is governed by the UK General Data Protection Regulation and supplemented by other domestic data protection laws, such as the UK Data Protection Act 2018, which authorizes fines of up to £17.5 million or 4% of annual global revenue, whichever is higher. We are also exposed to potentially divergent enforcement actions for certain violations. Furthermore, the new SCCs apply only to the transfer of personal data outside the EU and not the UK. Although the European Commission adopted an adequacy decision for the UK on June 28, 2021, allowing the continued flow of personal data from the EU to the UK, this decision will be regularly reviewed going forward and may be revoked if the UK diverges from its current adequate data protection laws following its exit from the EU. On February 2, 2022, the UK’s Information Commissioner’s Office issued new standard contractual clauses to support personal data transfers out of the UK (“UK SCCs”), which became effective March 21, 2022. Following issuance of a U.S. executive order, a new framework, the EU-U.S. Data Privacy Framework (“DPF”) was created. Following an adequacy decision issued by the European Commission on July 10, 2023, the DPF, along with a UK extension to the DPF that allows the transfer of personal data from the UK to the U.S. (the “UK DPF Extension”) and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”), are available for companies to make use of to legitimize personal data transfers to the U.S. from the European Economic Area, Switzerland, and UK. We have certified to the U.S. Department of Commerce that we adhere to the DPF, UK DPF Extension, and Swiss-U.S. DPF. However, the DPF has been subject to a legal challenge, and it, the UK DPF Extension, and the Swiss-U.S. DPF may be subject to legal challenges in the future from privacy advocacy groups or others. Further, the European Commission’s adequacy decision regarding the EU-U.S. DPF provides that the EU-U.S. DPF will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. We may, in addition to other impacts, experience additional costs associated with increased compliance burdens and be required to engage in new contract negotiations with third parties that aid in processing personal data on our behalf or localize certain personal data.

Read in the 10-K filed Mar 6, 2025 ↗

Further, several European data protection authorities have indicated that the use of Google Analytics by European website operators involves the unlawful transfer of personal data to the United States. As the enforcement landscape further develops,

Read in the 10-K filed Mar 6, 2025 ↗

Several other countries, including China, Australia, New Zealand, Brazil, and Japan, have also established specific legal requirements for cross-border data transfers. There is also an increasing trend towards data localization policies. For example, China and India have introduced localization requirements for certain data. Other countries also are considering data localization requirements. If this trend continues, and countries implement more restrictive regulations for cross-border personal data transfers (or do not permit personal data to leave the country of origin), it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and our business, financial condition, and results of operations in those jurisdictions could be impacted.

Read in the 10-K filed Mar 6, 2025 ↗

•regional data privacy laws and other regulatory requirements that apply to outsourced service providers and to the transmission of our customers’ data across international borders;

Read in the 10-K filed Mar 5, 2025 ↗

We are increasingly building AI into many of our offerings, including generative and agentic AI. As with many innovations, AI offerings, such as Agentforce, and our Salesforce Platform present additional risks and challenges that could affect their adoption and therefore our business. For example, the development of our AI offerings and the Salesforce Platform, which provides information regarding our customers’ customers, present emerging ethical issues. If we enable or offer solutions that draw controversy due to their perceived or actual impact on human rights, privacy, employment, or in other social contexts, we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm or legal liability, especially as geopolitical turmoil creates increasingly volatile political and market conditions. Inadequate or ineffective AI development, deployment, content labeling or governance by us or others that result in controversy could also impair the acceptance of AI solutions or result in unintended performance of the services. This in turn could undermine confidence in the decisions, predictions, analysis or other content that our AI applications produce, subjecting us to competitive harm, legal liability and brand or reputational harm. The rapid evolution of AI will require the application of resources to develop, test and maintain our products and services to help ensure that AI is implemented ethically in order to minimize unintended, harmful impact. Uncertainty around new and emerging AI applications such as generative AI content creation and AI agents will require additional investment in compliance, governance and the licensing or development of proprietary datasets, machine learning models and systems to test for accuracy, bias and other variables, which are often complex, may be costly and could impact our profit margin. Moreover, the move from AI content classification to AI content generation through our development of Agentforce and other generative AI products brings additional risks and responsibility. Known risks of generative AI currently include risks related to accuracy, bias, toxicity, privacy and security and data provenance. For example, AI technologies, including generative AI, may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed or protected content to their detriment, or the owners of such copyrighted material seek to enforce their rights, we may be exposed to brand or reputational harm, competitive harm and/or legal liability. Developing, testing and deploying AI systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems. If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results and financial condition may be harmed.

Read in the 10-K filed Mar 5, 2025 ↗

In connection with the operation of our business, particularly in relation to our identity and information protection service and financial technology offerings, we collect, use, process, store, transmit or disclose (collectively, process) an increasingly large amount of confidential information, including personal information (which includes credit card information and other critical data) from employees and customers in multiple jurisdictions. The confidential and personal information we process is subject to an increasing number of federal, state, local and foreign laws regarding privacy, data security and the collection, and handling of PII and sensitive data, as well as contractual commitments, and this regulatory framework is rapidly evolving and likely to remain uncertain for the foreseeable future. For example, at the federal level, the GLBA (along with its implementing regulations) requires disclosures to consumers about our handling of their nonpublic personal information and empowers consumers to place restrictions on, or opt out of, our sharing nonpublic personal information with affiliated and nonaffiliated their parties for various purposes. Additionally, our investment adviser, ML Wealth, and broker-dealer, MoneyLion Securities LLC, are subject to SEC Regulation S-P, which requires that covered institutions maintain certain policies and procedures addressing the protection of consumer information and records.

Read in the 10-K filed May 15, 2025 ↗

We are, and may in the future become, subject to litigation, claims, examinations, investigations, legal and administrative cases and proceedings, whether civil or criminal, or lawsuits by governmental agencies or private parties, which may affect our business, financial condition, results of operations and cash flows. These claims, lawsuits and proceedings could involve labor and employment, discrimination and harassment, commercial disputes, class actions, general contract, tort, defamation, data privacy rights, antitrust, common law fraud, government regulation, compliance, alleged federal and state securities and “blue sky” law violations or other investor claims and other matters. For a discussion of specific legal proceedings to which we are currently subject. Refer to Note 18 of the Notes to the Consolidated Financial Statements included in this Annual Report on Form 10-K.

Read in the 10-K filed May 15, 2025 ↗

Furthermore, we are required to comply with laws and regulations that require us to maintain security measures designed to protect personal information and we may have contractual and other legal obligations to notify customers, regulators, government agencies, impacted individuals or other relevant stakeholders of security breaches. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. Consequences associated with such security incidents may include: government enforcement actions and other actions or proceedings (for example, investigations, audits, and inspections), and related fines, penalties, required remedial actions, or other obligations and liabilities; additional reporting requirements and/or oversight; restrictions on processing or transferring data (including personal data); claims, demands, and litigation (including class claims); indemnification obligations; monetary fund diversions; interruptions in our operations (including availability of data); financial loss and other similar harms. Actual and perceived security incidents and attendant consequences could also lead to negative publicity and reputational harm, may cause our customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or mitigate the security incident. Accordingly, if our cybersecurity measures or those of our third-party service providers fail to protect against unauthorized access, attacks (which may include sophisticated cyberattacks), or if our employees or contractors compromise or mishandle data, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected.

Read in the 10-K filed Feb 26, 2025 ↗

While we maintain errors, omissions and cyber liability insurance policies covering certain security and privacy damages, we cannot be certain that our existing insurance coverage will continue to be available on acceptable terms or will be

Read in the 10-K filed Feb 26, 2025 ↗

We and our customers are subject to numerous domestic (for example, the California Consumer Privacy Act (“CCPA”)) and foreign (for example, the General Data Protection Regulation (“GDPR”) in the European Union (“EU”)) privacy, data protection and cybersecurity laws and regulations that restrict the collection, use, disclosure and processing of personal information, including financial and health data. These laws and regulations are expanding globally, evolving, and being tested in courts, may result in increasing regulatory and public scrutiny of our practices relating to personal information and may increase our exposure to regulatory enforcement action, sanctions and litigation. The breadth and depth of changes in data protection obligations has required significant time and resources, including a review of our technology and systems against the requirements of the GDPR.

Read in the 10-K filed Feb 26, 2025 ↗

The CCPA (as amended by the California Privacy Rights Act of 2020) imposes obligations on businesses to which it applies. These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents (both consumers and employees) certain rights related to their personal information. The CCPA allows for statutory fines for noncompliance. Similar laws have been enacted in 18 other states with 13 laws currently in effect and the remainder becoming effective later in 2025 and 2026. Numerous other states, and the U.S. federal government, also have proposed general privacy legislation recently. Additionally, other states have proposed, and in certain cases enacted, other laws and regulations addressing privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action. If we become subject to new privacy, data protection or cybersecurity laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase, including individuals, via a private right of action, and state actors.

Read in the 10-K filed Feb 26, 2025 ↗

Outside the United States, an increasing number of laws, regulations, and industry standards apply to privacy, data protection and cybersecurity. For example, the GDPR, the United Kingdom’s General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”) and the Swiss Federal Act on Data Protection, impose strict requirements for processing the personal information of individuals protected by the legislation, whether their data is processed within or outside the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, respectively (such jurisdictions, collectively, “Europe”). For example, the GDPR imposes significant requirements regarding the processing of individuals’ personal information, including in relation to transparency, lawfulness of processing, individuals’ privacy rights, compliant contracting, data minimization, data breach notification, data re-usage, data retention, security of processing and international data transfers. Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data processing or data transfers, require a company to delete data, as well as impose significant fines, potentially ranging up to 20 million Euros under the GDPR, 17.5 million GBP under the UK GDPR, or 4% of a company’s worldwide revenue, whichever is higher. Further, individuals may initiate compensation claims or litigation related to our processing of their personal information. Other privacy and data protection laws in Europe impose strict requirements around marketing communications and the deployment of cookies on users’ devices. As another example, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018) may apply to our operations. The LGPD broadly regulates processing of personal information of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the GDPR. Additionally, we expect an increase in the regulation of the use of AI and ML in products and services. For example, in Europe, the Artificial Intelligence Act (“AI Act”), once effective, will impose onerous obligations related to the development, placing on the market and use of AI-related systems. In the United States, numerous states have established study commissions that could lead to regulation of AI, and certain states have enacted legislation regulating aspects of AI. Other countries also are contemplating laws regulating AI and ML. We may have to change our business practices to comply with obligations under these or other new and evolving regimes.

Read in the 10-K filed Feb 26, 2025 ↗

Similarly, with our registration as an interconnected VoIP provider for certain products with the Federal Communications Commission (“FCC”), we also must comply with privacy laws associated with customer proprietary network information rules in the United States. In addition, states such as California have increasingly adopted or proposed, or may propose, regulations that may classify our services in such a manner as to subject us to additional privacy-related compliance obligations under state law. If we fail or are perceived to have failed to maintain compliance with these requirements, we could be subject to regulatory audits or inquiries, civil and criminal penalties, fines and breach of contract claims, as well as reputational damage, which could impact the willingness of customers to do business with us.

Read in the 10-K filed Feb 26, 2025 ↗

Evolving laws, regulations, and other actual and asserted obligations relating to privacy, data protection, and cybersecurity, as well as any new or evolving obligations relating to the use of AI and ML technologies, could reduce demand for our platform, increase our costs, impair our ability to grow our business, or restrict our ability to store and process data or, in some cases, impact our ability to offer our service in some locations and may subject us to liability. Further, in view of new or modified federal, state or foreign laws and regulations, industry standards, contractual obligations and other actual and asserted obligations, or any changes in their interpretation, we may find it necessary or desirable to fundamentally change our business activities and practices or to expend significant resources to modify our practices and platform and otherwise adapt to these changes. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited.

Read in the 10-K filed Feb 26, 2025 ↗

As a provider of communications products, we are subject to existing or potential FCC and state regulations relating to privacy, telecommunications, consumer protection and other requirements. In addition, the extension of telecommunications regulations to our non-interconnected VoIP services could result in additional federal and state regulatory obligations and taxes. We are also in discussions with certain jurisdictions regarding potential sales and other taxes for prior periods that we may owe. In the event any of these jurisdictions disagree with management’s assumptions and analysis, the assessment of our tax exposure could differ materially from management's current estimates, which may increase our costs of doing business and negatively affect the prices our customers pay for our services. If we do not comply with FCC rules and regulations, we could be subject to FCC enforcement actions, fines, loss of licenses and possibly restrictions on our ability to operate or offer certain of our products. For example, in 2023, we received a “cease-and-desist” letter from the FCC related to reported fraudulent traffic on our messaging platform. We subsequently removed the identified traffic and sent a follow-up letter to the agency detailing our fraud mitigation practices and various planned improvements to reduce future risks. Any enforcement action by the FCC, which may be a public process, would hurt our reputation in the industry, could erode customer trust, possibly impair our ability to sell our VoIP, other telecommunications products and/or other services to customers and could adversely affect our business, results of operations and financial condition.

Read in the 10-K filed Feb 26, 2025 ↗

Our customers use our solutions to collect, use, store, disclose, and otherwise process personal data regarding their employees, healthcare professionals, and patients. Patient data may include sensitive health data. In many countries, governmental bodies have adopted or may adopt laws and regulations regarding the security, collection, use, storage, disclosure, and other processing of personal data, making compliance an increasingly complex task.

Read in the 10-K filed Mar 24, 2025 ↗

Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud software and data providers. For example, in 2021, China adopted the Personal Information Protection Law, which, together with the Cybersecurity Law and the Data Security Law, require companies that process personal data of China residents above certain thresholds to seek approval from the Cyberspace Administration of China (CAC) to transfer such data outside of China. In 2023, certain of our Veeva CRM customers in China were required to request such approval from the CAC and had their requests denied. Customers required to request approval may need to implement a CRM solution that does not require data to be transferred outside of China and customers not subject to the requirement may nonetheless choose to do so. While we offer the China CRM Suite, a CRM solution that does not require data to be transferred outside of China, some customers have chosen, and other customers may choose, other CRM providers, which may negatively impact our CRM business in China. Currently, approximately 2% of our total revenue is attributable to China. Additionally, as we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations.

Read in the 10-K filed Mar 24, 2025 ↗

In the United States, the U.S. Department of Health and Human Services has promulgated privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that cover protected health information (PHI) by limiting use and disclosure and giving individuals the right to access, amend, and seek accounting of disclosures of their PHI. Certain of our customers may be either business associates or covered entities under HIPAA, which means we must maintain a HIPAA compliance program. There is also the potential for the U.S. federal government to pass additional data privacy laws.

Read in the 10-K filed Mar 24, 2025 ↗

U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information, create new privacy rights for individuals, and contain enhanced requirements for and restrictions on data brokers. For example, under the California Consumer Privacy Act (CCPA), as amended, we are generally considered a “service provider” for our software solutions and a “business” for our data products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, passed the My Health My Data Act, which became effective on March 21, 2024, establishing significant new restrictions on how businesses can collect, use, and disclose consumer health data. Veeva Crossix’s data platform combines large-scale data sets, inclusive of de-identified health and consumer data, to provide insights, analytics, and audience segmentation for our life sciences customers in the U.S. In response to the Washington law, we made modifications to our audience segments that may reduce demand for our Crossix products, which, in turn, could adversely impact the business. Other states have considered, and in certain cases enacted, similar laws. Additionally, the U.S. Department of Justice recently issued a final rule that takes effect on April 8, 2025, and places limitations, and in some cases prohibitions, on certain transfers of sensitive personal data to data to business partners located in China or with other specified links to China and other designated countries. These various laws, regulations, and legislative developments have potentially far-reaching consequences and have and may continue to require us to modify our solutions and data management practices and incur substantial expense in order to comply.

Read in the 10-K filed Mar 24, 2025 ↗