National and local governments and agencies in the countries in which we operate and in which our customers operate have adopted, are considering adopting, or may adopt laws and regulations regarding the collection, use, storage, disclosure, and other processing of information regarding consumers and other individuals, including our employees and employees of our service providers, which could impact our ability to offer services in certain jurisdictions. Laws and regulations relating to the collection, use, disclosure, security, and other processing of individuals' information are constantly evolving, can vary significantly from jurisdiction to jurisdiction and are particularly stringent in Europe, the United Kingdom, the United States and Japan. The costs of compliance with, and other burdens imposed by, laws, regulations, standards, and other obligations relating to privacy, data protection, and information security are significant. In addition, some companies, particularly larger enterprises, often will not contract with vendors that do not meet these rigorous standards. Accordingly, the failure, or perceived inability, to comply with these laws, regulations, standards, and other obligations may limit the use and adoption of our solutions, reduce overall demand, lead to regulatory investigations, litigation, and significant fines, penalties, or liabilities for actual or alleged noncompliance, or slow the pace at which we close sales transactions, any of which could harm our business. Moreover, if we or any of our employees or contractors fail or are believed to fail to adhere to appropriate practices regarding customers' data, it may damage our reputation and brand.
Additionally, existing laws, regulations, standards, and other obligations may be interpreted in new and differing manners in the future and may be inconsistent among jurisdictions. Future laws, regulations, standards, and other obligations, and changes in the interpretation of existing laws, regulations, standards, and other obligations could result in increased regulation, increased costs of compliance and penalties for non-compliance, and limitations on data collection, use, disclosure, and transfer for us and our customers.
Additionally, the European Union adopted the GDPR in 2016, and it became effective in May 2018. In Europe and the UK, we are subject to the GDPR, which imposes a comprehensive data privacy compliance regime. The GDPR regulates cross-border transfers of personal data out of the EEA and the UK. The GDPR regulates cross-border transfers of personal data out of the EEA and the UK. The European Union and United States agreed in 2016 to a framework for data transferred from the European Union to the United States (Privacy Shield) to relevant self-certified US entities, but this framework was challenged and declared invalid by the Court of Justice of the European Union ("CJEU") on July 16, 2020, thereby creating additional legal risks for us. In addition, the other bases on which we and our customers rely for the transfer of personal data across national borders, such as the Standard Contractual Clauses promulgated and modernized by the EU Commission on June 4, 2021 (and the UK Addendum to the EU standard contractual clauses/UK International Data Transfer Agreement), commonly referred to as the Model Clauses, continue to be subjected to regulatory and judicial scrutiny. For example, the CJEU noted in its decision of July 16, 2020 that reliance on the Model Clauses alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. Following a period of legal complexity and uncertainty regarding international personal data transfers, particularly to the United States, we expect the regulatory guidance and enforcement landscape to continue to develop, in relation to transfers to the United States and elsewhere. If we or our customers are unable to transfer data between and among countries and regions in which we operate, it could decrease demand for our products and services or require us to modify or restrict some of our products or services. In addition, the other bases on which we and our customers rely for the transfer of personal data across national borders, such as the Standard Contractual Clauses promulgated and modernized by the EU Commission on June 4, 2021, commonly referred to as the Model Clauses, continue to be subjected to regulatory and judicial scrutiny. If we or our customers are unable to transfer data between and among countries and regions in which we operate, it could decrease demand for our products and services or require us to modify or restrict some of our products or services. Further, certain US states have adopted new or modified privacy and security laws and regulations that may apply to our business. For example, California adopted the CCPA, which went into effect in 2020 and was amended by the California Privacy Rights Act, which went into effect on July 1, 2023. Although we initiated a compliance program designed to ensure CCPA compliance after consulting with outside privacy counsel, we may remain exposed to ongoing legal risks related to the CCPA and the California Privacy Rights Act, as well as similar legislation passed in Virginia, Colorado, Connecticut, Utah, Indiana, Iowa, Montana, Tennessee, Texas, Oregon. Further, other states considering such laws, and there remains increased interest at the federal level. Additionally, Singapore adopted the PDPA in 2012, which was amended in 2022 to introduce (amongst other matters), an increased financial penalty cap and the mandatory data breach notification requirement.
The costs of compliance with, and other burdens imposed by, laws and regulations relating to privacy, data protection, and information security that are applicable to the businesses of customers may adversely affect our ability and willingness to handle, store, use, transmit and otherwise process certain types of information, such as demographic and other personal information, limit the use and adoption of our products and services and could have an adverse impact on our business.
In addition to government activity, privacy advocacy groups, the technology industry, and other industries have established or may establish various new, additional, or different self-regulatory standards that may place additional burdens on technology companies. Customers may expect that we will meet voluntary certifications or adhere to other standards established by them or third parties. If we are unable to maintain these certifications or meet these standards, it could reduce demand for our solutions and adversely affect our business.