We use information technology and third-party service providers to support our global business processes and activities, including supporting critical business operations such as manufacturing and distribution; communicating with our suppliers, customers and employees; maintaining effective accounting processes and financial and disclosure controls; executing mergers and acquisitions and other corporate transactions; conducting research and development activities; meeting regulatory, legal and tax requirements; and executing various digital marketing and consumer promotion activities. Global shared service centers managed by third parties provide an increasing number of services important to conducting our business, including accounting, internal control, human resources and computing functions.
Continuity of business applications and services has been, and may in the future be, disrupted by events such as infection by viruses or malware; other cybersecurity attacks; issues with or errors in systems' maintenance or security; power outages; hardware or software failures; denial of service attacks; telecommunication failures; natural disasters; terrorist attacks; and other catastrophic occurrences. Our use of new and emerging technologies such as cloud-based services and mobile applications continues to evolve, presenting new and additional risks in managing access to our data, relying on third parties to manage and safeguard data, ensuring access to our systems and availability of third-party systems. In addition, we are experiencing new and more frequent attempts by third parties to gain access to our systems, such as through increased email phishing of our workforce.
We leverage third parties for various technology and business services who may experience cybersecurity breaches, whether from circumvention of security systems, denial-of-service attacks or other cyberattacks such as hacking, phishing attacks, computer viruses, ransomware or malware, cyber extortion, employee or insider error, malfeasance, social engineering, physical breaches or other actions or attempts to exploit vulnerabilities may cause confidential information or Personally Identifiable Information belonging to us or our employees, customers,consumers, partners, suppliers, or governmental or regulatory authorities to be misused or breached. These risks could be magnified since the number of employees, contractors and others working outside of offices increased since the COVID-19 pandemic. Additionally, continued geopolitical turmoil, including the ongoing war in Ukraine, has heightened the risk of cyberattacks. When risks such as these materialize, the need for us to coordinate with various third-party service providers and for third-party service providers to coordinate amongst themselves might increase challenges and costs to resolve related issues. Our information security program includes capabilities designed to evaluate and mitigate cyber risks arising from third-party service providers. Cyber threats to externally-hosted technology and business services are beyond our control. Additionally, new initiatives, such as those related to digital commerce and direct sales, that increase the amount of confidential information that we process and maintain increase our potential exposure to a cybersecurity breach. Furthermore, the rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks. If our controls, disaster recovery and business continuity plans or those of our third-party providers do not effectively respond to or resolve the issues related to any such disruptions in a timely manner, our product sales, financial condition, results of operations and stock price may be materially and adversely affected, and we might experience delays in reporting our financial results, loss of intellectual property and damage to our reputation or brands.
We continue to invest and augment our cybersecurity program and posture with enhanced identity and access management solutions, multi-factor authentication, risk-based access for remote connectivity, privileged access management, network security, backup and disaster recovery, training and awareness, in addition to advance threat protection emanating from sophisticated, persistent and state-sponsored threat actors, including from internet browsing to email, further reducing our attack surface and likelihood of credential thefts and compromise. Further, we have 24/7 security operations, enhancing the monitoring and detection of threats in our environment, including but not limited to the manufacturing environment and operational technologies, as well as adjusting information security controls based on our threat intelligence information. However, security measures cannot provide absolute security or guarantee that we will be successful in preventing or responding to every breach or disruption on a timely basis. Due to the constantly evolving and complex nature of cyber threat actors, we cannot predict the form and impact of any future incident, and the cost and operational expense of implementing, maintaining and enhancing protective measures to guard against increasingly complex and sophisticated cyber threats could increase significantly. Moreover, as cyberattacks increase in frequency and magnitude around the world, we may be unable to obtain cybersecurity insurance in the amounts and on terms we view as appropriate and favorable for our operations.
We transfer data across local, regional, and national borders to conduct our operations, and we are subject to a variety of continuously evolving and developing laws and regulations in numerous jurisdictions regarding privacy, data protection and data security, including those related to the collection, storage, handling, use, disclosure, transfer and security of personal data. Privacy and data protection laws may be interpreted and applied differently from jurisdiction to jurisdiction and may create inconsistent or conflicting requirements. The European Union's General Data Protection Regulation ("GDPR") has greatly increased the jurisdictional reach of E.U. law, added a broad array of requirements for handling personal data including the public disclosure of significant data breaches, and imposes substantial penalties for non-compliance of up to 4% of global annual revenue for the preceding financial year in addition to potential restrictions on data transfer and processing. Laws recently passed in other jurisdictions, such as the Personal Information Protection Law of 2021, enacted in China, and the Digital Personal Data Protection Act of 2023, enacted in India, similarly impose significant regulatory requirements. The California Consumer Privacy Act ("CCPA") requires greater transparency in handling personal information from consumers by imposing new responsibilities for the handling, disclosure and deletion of personal information for consumers, permits California to assess potentially significant fines for violating CCPA and creates a right for individuals to bring class action suits seeking damages for violations. In addition, similar legislation in Virginia, Colorado, Utah and Connecticut, all of which have gone into effect or will go into effect during 2023, impose transparency and other obligations with respect to personal data of their respective residents and provide residents with similar rights. Our efforts to comply with multijurisdictional privacy and data protection laws and the uncertainty of new laws and regulations will likely increase the complexity of our processes and may impose significant costs and challenges that are likely to increase over time, and we could incur substantial penalties or be subject to litigation related to violation of existing or future data privacy laws and regulations.