Our business relies on the processing of data in many jurisdictions and the movement of data across national borders. The collection, storage, handling, disclosure, use, transfer and security of personal information that occurs in connection with our business is subject to federal, state and foreign data privacy laws. These legal requirements are not uniform and continue to evolve, and regulatory scrutiny in this area is increasing around the world. In many cases, these laws apply not only to third-party transactions, but also to transfers of information within the Group. Privacy and data protection laws may be interpreted and applied differently from country to country and may create inconsistent or conflicting requirements.
The General Data Privacy Regulation ("GDPR") has extra-territorial effect. It requires all companies processing data of E.U. citizens to comply with the GDPR, regardless of the company's location, and also imposes obligations on E.U. companies processing data of non-E.U. citizens. In particular, the GDPR imposes requirements regarding the processing of personal data and confers new rights on data subjects, including rights of access to their personal data, deletion of their personal data, the "right to be forgotten" and the right to "portability" of personal data. In the U.K., the Data Protection Act 2018 and the U.K. General Data Protection Regulation, which is the retained E.U. law version of the GDPR by virtue of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (E.U. Exit) Regulations 2019 (collectively, "U.K. GDPR"), regulates data protection for all individuals within the U.K. and applies to all our subsidiaries operating in the U.K. On September 1, 2023, Switzerland's revised Federal Act on Data Protection ("FADP"") came into effect, which like other privacy laws grants Swiss citizens privacy rights.
The California Consumer Privacy Act ("CCPA") effective on January 1, 2020 confers rights on California residents including rights to know what personal information is collected about them and whether their personal information is sold (and if so, to whom), to access any personal information that has been collected and to require a business to delete their personal information. The California Privacy Rights Act ("CPRA") took effect on January 1, 2023 with a "look back" to January 1, 2022, meaning that data collected in the 2022 calendar year became subject to the terms of the CPRA beginning on January 1, 2023. The California Privacy Protection Agency ("CPPA") also promulgated CPRA regulations that will become enforceable on March 29, 2024. The CCPA is expected to promulgate further CPRA regulations in the near future. The CPRA will work as an addendum to the CCPA, strengthening the rights of California residents, tightening business regulations on the use of personal information and establishing the CPPA as the state-wide data privacy enforcer. Washington state also passed the My Health My Data act ("MHMD"), which comes into effect March 29, 2024. MHDA is limited to certain health data, but individuals in Washington will have similar privacy rights for some health data that is covered under this law. Overall, in the US, there continues to be a lot of changes in the data protection and privacy landscape, which we continue to expect next year. As states continue to focus on data protection, our compliance burden may increase.
Compliance with the enhanced obligations imposed by data protection and other legislation, including Singapore's amended Personal Data Protection Act, Bermuda's Personal Information Protection Act, and Quebec's Law 25, requires investment in appropriate technical or organizational measures to safeguard the rights and freedoms of data subjects. Such investment may result in significant costs to our business and may require us to modify certain of our business practices. In addition, enforcement actions, investigations and the imposition of substantial fines and penalties by regulatory authorities as a result of data security incidents and privacy violations have increased dramatically over the past several years. The enactment of more restrictive laws, rules, regulations or future enforcement actions or investigations could impact us through increased costs or restrictions on our business, and noncompliance could result in regulatory penalties and significant legal liability.
Unauthorized disclosure or transfer of sensitive or confidential client or Company data, whether through systems failure, employee negligence, fraud or misappropriation, by the Company or other parties with whom we do business, could also subject us to significant litigation, monetary damages, regulatory enforcement actions, fines and criminal prosecution in one or more jurisdictions. Such events could also result in negative publicity and damage to our reputation and cause us to lose business, which could therefore have a material adverse effect on our results of operations or financial condition.