In the ordinary course of our business, we collect and store sensitive data, intellectual property and proprietary business information owned or controlled by ourselves or our customers. This data encompasses a wide variety of business-critical information including research and development information, commercial information, and business and financial information. We face four primary risks relative to protecting this critical information: loss of access; inappropriate disclosure; inappropriate modification; and inadequate monitoring of our controls over the first three risks.
The secure processing, storage, maintenance, and transmission of this critical information is vital to our operations and business strategy, and we devote significant resources to protecting such information. Although we take measures to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses, breaches, interruptions due to employee error, malfeasance, lapses in compliance with privacy and security mandates, or other disruptions. Any such breach or interruption could compromise our networks and the information stored there could be accessed by unauthorized parties, publicly disclosed, lost, or stolen.
Any such security breach or interruption, as well as any action by us or our employees or contractors that might be inconsistent with the rapidly evolving data privacy and security laws and regulations applicable within the United States and elsewhere where we conduct business, could result in enforcement actions by U.S. states, the U.S. federal government or foreign governments, liability or sanctions under data privacy laws that protect personally identifiable information, regulatory penalties, other legal proceedings such as but not limited to private litigation, the incurrence of significant remediation costs, disruptions to our development programs, business operations and collaborations, diversion of management efforts and damage to our reputation, which could harm our business and operations. Because of the rapidly moving nature of technology and the increasing sophistication of cybersecurity threats, our measures to prevent, respond to and minimize such risks may be unsuccessful.
In addition, the European Parliament and the Council of the European Union adopted a comprehensive general data privacy regulation, or GDPR, in 2016 to replace the current European Union Data Protection Directive and related country specific legislation. The GDPR took effect in May 2018 and governs the collection and use of personal data in the European Union. The GDPR, which is wide-ranging in scope, will impose several requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals, the security and confidentiality of the personal data, data breach notification and the use of third-party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the European Union to the United States, enhances enforcement authority and imposes large penalties for noncompliance, including the potential for fines of up to €20 million or 4% of the annual global revenues of the infringer, whichever is greater. While we have taken steps to comply with the GDPR, including such as reviewing our security procedures and entering into data processing agreements with relevant contractors, we cannot assure you that our efforts to remain in compliance will be fully successful.
Further, unauthorized access, loss or dissemination of sensitive information could also disrupt our operations, including our ability to conduct research and development activities, process and prepare company financial information, manage various general and administrative aspects of our business and damage our reputation, any of which could adversely affect our reputation and our business. In addition, there can be no assurance that we will promptly detect any such disruption or security breach, if at all. To the extent that any disruption or security breach were to result in a loss of or damage to our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability and the further development of our products could be delayed.