In the conduct of our business, we increasingly collect, use, transmit and store data on information technology systems. This data includes confidential information belonging to us, our customers and other business partners, as well as personally identifiable information of individuals, including our employees. Like other global companies, we have experienced, and expect to continue to be subject to, cybersecurity threats and incidents, ranging from employee error or misuse, individual attempts to gain unauthorized access to information technology systems, and to sophisticated and targeted measures known as advanced persistent threats, none of which have been material to the Company to date.
Although we devote significant resources to network security, data encryption and other measures to protect our information technology systems and data from unauthorized access or misuse, including those measures necessary to meet certain information security standards that may be required by our customers, there can be no assurance that these measures will be successful in preventing a cybersecurity or general information security incident. We also rely in part on the reliability of certain tested third parties' cybersecurity measures, including firewalls, virus solutions and backup solutions, and our business may be affected if these third-party resources are compromised.
Cybersecurity incidents may result in business disruption, the misappropriation, corruption or loss of confidential information (including personally identifiable information) and critical data (ours or that of third parties), reputational damage, litigation with third parties, regulatory fines, diminution in the value of our investment in research and development and data privacy issues and increased information security protection and remediation costs. As these cybersecurity threats, and government and regulatory oversight of associated risks,continue to evolve, we may be required to expend additional resources to remediate, enhance or expand upon the cybersecurity protection and security measures we currently maintain. For example, we are subject to the European Union's General Data Protection Regulation ("GDPR"), which became enforceable from May 25, 2018, and, following the U.K.'s exit from the E.U. on January 31, 2020, our U.K. based businesses are subject to U.K.-GDPR, which enshrines equivalent requirements in U.K. law. The GDPR introduced a number of new obligations for subject companies, resulting in the need to continue dedicating financial resources and management time to GDPR compliance. Among other things, the GDPR places subject companies under obligations relating to the security of the personally identifiable information they process. While we have taken steps to ensure compliance with the GDPR, there can be no assurance that the measures we have taken will be successful in preventing an incident, including a cybersecurity incident or other data breach, which results in a breach of the GDPR. Fines for non-compliance with the GDPR may be levied up to a maximum of €20,000,000 or 4% of the subject company's annual, group-wide turnover (whichever is higher). Individuals who have suffered damage as a result of a subject company's non-compliance with the GDPR also have the right to seek compensation from such a company.
Future cybersecurity breaches, general information security incidents, further increases in data protection costs or failure to comply with relevant legal obligations regarding protection of data could therefore have a material adverse effect on our results of operations, financial position and cash flows. See ITEM 1C for further information regarding disclosed our Cybersecurity procedures.