Align Technology Inc.: 10-K Risk Factor Changes

We are or may become, or alleged to be or become, subject to stringent federal, state, and foreign laws and regulations, such as HIPAA, which regulates the security and privacy of patient healthcare information applicable to healthcare providers and their business associates, and the California Consumer Protection Act, as amended by the California Privacy Rights Act, which regulates privacy, data security, content regulation and consumer protection. Numerous other states have enacted, or plan to enact, laws relating to privacy, data protection, data governance and cybersecurity, with such enacted laws either in operation or slated to go into operation over the next several years. Outside of the United States, relevant legal requirements continue to evolve. For example, the collection and use of health data and other personal information is governed in the EU by the EU GDPR, which imposes significant obligations upon companies and rights for individuals, with substantial penalties for noncompliance. Numerous other jurisdictions maintain similar legislation or other laws or regulations addressing privacy, data protection, data governance, or cybersecurity. Several jurisdictions, including the EU, United States, China, Australia, and Japan, have enacted data export restrictions and international transfer laws and regulations that established legal requirements for cross-border transfers of all or certain personal information and certain jurisdictions have also established legal requirements for data localization, which may require us to maintain separate servers located in those countries so that all or certain personal information are maintained locally. These laws, regulations and other obligations relating to privacy, data protection, data governance and cybersecurity are constantly evolving and may be created, interpreted or enforced in ways that could impose new, substantially uncertain, and relatively burdensome obligations on our global operations, restrict our activities and our ability to provide our products and services in certain jurisdictions, require us to cease operations or modify our policies and business practices in a materially limiting manner, prevent us from resolving issues quickly or force us to resolve them in unanticipated ways, require us to engage in additional contractual negotiations, increase our costs and obligations and limit our ability to efficiently transfer personal data across borders, cause us to incur significant costs, expenses and damages, and present challenges in adapting our policies and practices to address their requirements. Any failure or perceived failure by us or our vendors, customers, or service providers to comply with applicable privacy and data protection laws or to adequately safeguard personal data or patient healthcare information, even if unfounded, may result in regulatory investigations, enforcement actions, litigation (including class actions), and financial penalties, any of which could materially affect our operations and financial performance. Additionally, concerns over our practices with respect to privacy, data protection, data governance, and cybersecurity could adversely affect our reputation and deter customers and consumers from using our products and services. We have cybersecurity and other forms of insurance coverage related to cyberattacks, breaches, and other incidents or security problems, but we cannot guarantee applicable insurance will be available to us in the future on economically reasonable terms or at all. Damages and claims arising from incidents may not be covered, may exceed coverage limits, and may not cover the time and effort we incur investigating and responding to any incidents, or other costs or liabilities, which may be material. The costs to eliminate, mitigate, or recover from security problems and cybersecurity attacks and incidents could be material and require us to implement additional or different security controls or other measures and, depending on the nature and extent of the problem and the products, services or IT systems impacted, such security problems and cybersecurity attacks and incidents may result in network, IT system interruptions or other disruptions, decreased product sales, data loss, damage, unavailability, or other liabilities, any of which may have a material impact on our operations, net revenues and operating results. The costs associated with cybersecurity tools and infrastructure and competition for scarce cybersecurity and IT resources could limit our ability to identify, eliminate or remediate cybersecurity or other security vulnerabilities or problems or enact changes to minimize the attack surface of our network. 31 31 31