We rely upon the capacity, reliability and security of our information technology ("IT") systems across all of our major business functions, including our research and development, manufacturing, retail, financial and administrative functions. We also face the challenge of supporting our older systems and implementing upgrades when necessary. Our security measures are focused on the prevention, detection and remediation of damage from computer viruses, unauthorized access, cyber-attack, natural disasters and other similar disruptions. We may incur significant costs in order to implement the security measures that we feel are necessary to protect our IT systems. However, our IT systems may remain vulnerable to damage despite our implementation of security measures that we deem to be appropriate. In addition, we are also dependent on third parties to provide important IT services relating to, among other things, human resources, electronic communications and certain finance functions.
We collect and store sensitive data, including intellectual property, proprietary business information and the proprietary business information of our customers and suppliers, as well as personally identifiable information of our customers and associates, in data centers and on IT networks.
Additionally, we are subject to privacy, data protection, and information security laws and regulations ("Data Protection Laws") in the United States and in jurisdictions around the globe that restrict the use, disclosure, transfer and processing of personal data. For example, we are subject to the GDPR, the California Consumer Privacy Act ("CCPA"), and the Brazilian Lei Geral de Proteção de Dados. Costs to comply with these Data Protection Laws are significant and the failure to comply with these laws could result in material legal exposure and business impact. The GDPR, for example, imposes onerous accountability obligations on companies, with penalties for non-compliance of up to the greater of €20 million or four percent of annual global revenue. The GDPR, and other Data Protection Laws, also grant corrective powers to supervisory authorities, including the ability to impose a limit on processing personal data or to order companies to cease operations.
The Data Protection Laws are part of an evolving global data protection landscape in which the number, complexity, requirements and consequences of non-compliance with these laws are increasing. This landscape includes legislative proposals recently adopted or currently pending in the United States, at both the federal and state levels, as well as in other jurisdictions,implementing new or additional requirements for data protection that could further increase compliance costs, the cost and complexity of delivering our products and services, and significantly affect our business.
Any system failure, accident or security breach involving our or our third party's IT systems could result in disruptions to our operations. A breach in the security of our IT systems could include the theft of our intellectual property or trade secrets, negatively impact our manufacturing or retail operations, or result in the compromise of personal information of our employees, customers or suppliers. While we have, from time to time, experienced system failures, accidents and security and privacy breaches involving our IT systems, these incidents have not had a material impact on our operations, and we are not aware of any resulting theft, loss or disclosure of, or damage to, material data or confidential information. To the extent that any system failure, accident or security or privacy breach results in material disruptions to our operations or the theft, loss or disclosure of, or damage to, material data or confidential information, our reputation, business, results of operations and financial condition could be materially adversely affected.