The legislative and regulatory framework for privacy and data security is rapidly evolving and likely is to remain uncertain for the foreseeable future. In providing our platform to university clients and in operating our business, we collect and process regulated personal information from students, faculty, prospective students and employees. Our handling of this personal information is subject to a variety of laws and regulations, which have been adopted by federal, state and foreign governments to regulate the collection, distribution, use and storage of personal information. Any failure or perceived failure by us to comply with these data protection laws and regulations or any security incident that results in the unauthorized release or transfer of this personal information in our possession, could result in government enforcement actions, litigation, fines and penalties or adverse publicity, all of which could have an adverse effect on our reputation and business.
Various federal, state and foreign legislative, regulatory or other governmental bodies have adopted laws or regulations concerning privacy, security, data storage and data protection that could materially adversely impact our business. Moreover, much of the personal information we collect and process is regulated by multiple privacy laws across various jurisdictions. For example, the General Data Protection Regulation ("GDPR"), which took effect in May 2018, introduced robust requirements for the protection of personal data of individuals in the European Union ("EU") and substantial fines for non-compliance, including fines up to 4% of a Company's annual global revenue. However, with the withdrawal of the United Kingdom ("UK") from the EU in 2020, we must also now comply with the local laws of that jurisdiction such as the UK Data Protection Act 2018 and the UK General Data Protection Regulation. This introduces the risk of possible enforcement from a separate data protection authority, with its distinct power to impose substantial fines for non-compliance. As another example, in July 2020, South Africa's privacy law known as the Protection of Personal Information Act became effective, mandating new requirements for processing of personal information in South Africa, and our Company must comply with these laws.
We are also subject to evolving EU rules on data transfer, as we may transfer personal data from the European Economic Area to other jurisdictions. The invalidation of the EU-U.S. Privacy Shield framework in July 2020, enforcement action by certain EU data protection authorities (such as the Irish Data Protection Commission in May 2023) and introduction of updated Standard Contractual Clauses (SCC) in 2021 for alternative means of cross-border data transfer, results in additional complexity and risk to our compliance measures. The European Commission issued an adequacy decision in respect of the EU-US Data Privacy Framework on July 10, 2023, permitting transfers of personal data from the EU to U.S. organizations certified under the Framework, without additional transfer mechanisms. However, legal challenges to the validity of this adequacy decision have already been lodged in the EU, with further challenges expected.
Moreover, other new regulations, such as the Digital Services Act, which entered into force in the UK on November 16, 2022, and will apply to all EU member states in February 2024, and California's Age Appropriate Design Code, passed in August 2022 and going into effect in July 2024, place additional obligations on online platforms and the ways in which they handle, share and disclose data.
In the U.S., the California Consumer Privacy Act ("CCPA") took effect in January 2020. Pursuant to the CCPA, we are required, among other things, to meet certain enhanced notice requirements to California residents regarding our use or disclosure of their personal information, allow California residents to opt-out of certain uses and disclosures of their personal information without penalty, and provide Californians with other choices related to personal data in our possession. The California Attorney General may seek substantial monetary penalties and injunctive relief in the event of our non-compliance with the CCPA. The CCPA also allows for private lawsuits from Californians in the event of certain data breaches. The CCPA was amended by the California Privacy Rights Act ("CPRA"), which went into effect on January 1, 2023 (regulations pending). CPRA places additional obligations on covered businesses regarding consumer opt-out rights and use of sensitive data, among other requirements. Moreover, Virginia, Utah, Connecticut and Colorado all have passed new privacy laws that went into effect in 2023. New privacy laws have also recently been passed in Indiana, Iowa, Montana, and Tennessee, which will go into effect between 2024 and 2026. There are a number of additional proposals for U.S. federal and state privacy laws that, if passed, could increase our potential liability, add layers of complexity to compliance in the U.S. market, increase our compliance costs, and adversely impact our business. However, without an overarching federal law driving privacy compliance in the U.S., the risk is high of a patchwork of privacy legislation formed by individual state laws, similar to the states' approach to breach notification obligations. This could not only increase costs for compliance but also raise the risk of enforcement by individual state attorneys general.
We also expect that there will continue to be new proposed laws, regulations, rulings and industry standards concerning privacy, security, data storage and data protection in the U.S., the EU and other jurisdictions, and we cannot yet determine the impact such future laws, regulations, rulings and standards may have on our business. For example, the European ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC), which obliges EU member states to introduce certain national laws regulating privacy in the electronic communications sector, will soon be replaced by the ePrivacy Regulation. As the text of the ePrivacy Regulation is still under development and in draft form, and as further guidance is issued and interpretations of both the ePrivacy Regulation and the GDPR develop, it is difficult to assess the impact of either on our business or operations, but it may require us to modify our data practices and policies. In addition, in 2021 new privacy laws were passed in China, Brazil and other jurisdictions, and in 2023, a new privacy law was passed in India. Many countries are considering updates to their current data protection regulations, including Australia.
Complying with these and other changing requirements could cause us to incur substantial costs, or require us to change our business practices, any of which could materially adversely affect our business and operating results.