Cybersecurity and data privacy risks have received heightened legislative and regulatory attention. In Europe and the U.K., their respective General Data Protection Regulations (collectively, “GDPR”) extends the scope of their data protection laws to all companies processing data of individuals within the E.U. and the U.K., regardless of the company’s location, subject to certain limitations. The law requires companies to meet stringent requirements regarding the handling of personal data. E.U. and U.K. data protection law continuously develops and requires significant changes to our policies and procedures. GDPR imposes strict rules on the transfer of personal data out of the E.U. or U.K. to a “third country,” including the United States, unless particular transfer mechanisms are implemented. The mechanisms that we and many other companies rely upon for such data transfers are the subject of legal challenge, regulatory interpretation, and judicial decisions. In the E.U., U.K. and other markets, potential new rules and restrictions on the flow of data across borders could increase the cost and complexity of doing business in those regions. Additionally, we are subject to the E.U. Regulation known as the Digital Operational Resilience Act (“DORA”). DORA is intended to strengthen the information technology systems of covered financial entities to mitigate risks associated with operational disruptions. Our efforts to comply with E.U., U.K. and other cybersecurity, privacy and data protection laws around the world that apply to our businesses could involve substantial expenses, divert resources from other initiatives and projects and limit the services we are able to offer. There is also increased focus on data localization requirements around the world in countries such as the United Arab Emirates, China and India which could impact our business model with respect to our storage and transfer of personal data.
In addition, U.S. regulators, including the U.S. Federal Banking Agencies and the U.S. Federal Trade Commission (“FTC”) have adopted or proposed enhanced cyber and privacy security standards that apply to us and our financial institution clients and address privacy requirements for processing data of individuals, cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience and situational awareness. The FTC and many state attorneys general are also interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, and security of data. Additionally, over a third of U.S. states have proposed or enacted comprehensive consumer privacy laws (such as the California Consumer Privacy Act) that have taken effect or will take effect in coming years. We cannot fully predict the impact of recently proposed or enacted laws or regulations on our business or operations, but compliance may require us to modify our data processing practices and policies incurring costs and expense. Legislation and regulations on cybersecurity, data privacy and data localization may compel us to enhance or modify our systems, invest in new systems or alter our business practices or our policies on how we process personal information, data governance and privacy. If any of these outcomes were to occur, our operational costs could increase significantly. Failure to comply with applicable laws in this area could also result in significant fines, penalties and reputational damage.