Our strategy to digitize Autodesk involves increasing our use of cloud- and web-based technologies and applications to leverage customer data to improve our offerings for the benefit of our customers. To accomplish this strategy, we must collect and otherwise process customer data, which may include personal data and personal information of users from different jurisdictions globally. We also collect and otherwise process personal data and personal information of our employees and contractors. As a result, numerous federal, state, and global laws and regulations relating to privacy, data protection, cybersecurity, and the collection, use, security, and other processing of personal data, personal information, and other data and information, apply to our data and information processing activities. The scope of these laws and regulations is rapidly evolving, subject to differing interpretations, may be inconsistent among jurisdictions, or conflict with other rules and is likely to remain uncertain for the foreseeable future. We also expect that there will continue to be new laws, regulations, and industry standards concerning these matters proposed and enacted in various jurisdictions. Globally, laws such as the General Data Protection Regulation ("EU") 2016/679 ("GDPR") in the European Union and the Personal Information Protection Law ("PIPL") in China have been enacted, and numerous other countries have proposed or have enacted laws concerning these matters, and we expect new laws, regulations, and industry standards concerning these matters to be proposed and enacted in various jurisdictions. In addition, new and emerging laws and regulations in the United States governing privacy, data protection, and cybersecurity, such as the California Consumer Privacy Act ("CCPA"), the California Privacy Rights Act ("CPRA"), other laws and regulations in other states, and numerous laws and regulations at the U.S. federal level, have been enacted or otherwise promulgated. These laws and regulations, as well as industry self-regulatory codes, industry standards, and other actual and asserted obligations to which we are or may be asserted to be subject, create new compliance obligations and substantially expand the scope of potential liability and provide greater penalties for non-compliance. For example, the GDPR provides for penalties of up to €20 million or 4% of a company's annual global revenue, whichever is greater, the PIPL provides for penalties of up to 50 million renminbi or 5% of a company's annual revenue and disgorgement of all illegal gains, whichever is greater, and the CCPA provides for penalties of up to $7,500 per violation. These laws, regulations, and codes may also impact our innovation and business drivers in developing new and emerging technologies (e.g., AI and machine learning). These requirements, among others, may impact demand for our offerings and force us to bear the burden of expanded obligations in our contracts.
Many laws and regulations relating to privacy and data protection impose restrictions on cross-border transfers of personal data. Available data transfer mechanisms impose obligations on us and other companies that engage in cross-border personal data transfers and are complex, uncertain, and subject to active litigation and enforcement actions in a number of jurisdictions around the world. Data transfer mechanisms may be challenged, revoked, or otherwise modified. Numerous jurisdictions also have imposed data localization requirements, and we have faced, and expect to continue to face, customer requirements to maintain data in particular jurisdictions. We may, in addition to other impacts in connection with personal data transfer mechanisms or data localization requirements, be required to expend significant time and resources to update contractual arrangements and to comply with new and evolving obligations, experience additional costs associated with increased compliance burdens, and find it necessary or appropriate to stop using certain service providers, engage in new contract negotiations, localize certain personal data, or make other operational changes, all of which may impact our business, financial condition, and results of operations. Further, we face exposure to regulatory complaints, actions, and other proceedings, and the potential for substantial fines, other liabilities, and injunctions or other imposed requirements, in connection with transfers of personal data and data localization requirements.
In addition, the CPRA and many other recently enacted state laws addressing privacy and cybersecurity provide for additional obligations and grant additional rights to consumers such as correction of personal information and additional opt-out rights. These laws have required us to modify our data processing practices and policies and may cause us to make additional modifications, and to incur substantial costs and expenses, in our efforts to comply. Additionally, privacy advocacy groups and technology and other industries are considering various new, additional, or different self-regulatory standards that may place, or be asserted to place, additional burdens on us.
Evolving legislation and the interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues. These, as well as conflicting obligations imposed by laws and regulations in various jurisdictions around the world, have caused and may cause variation in requirements, increase restrictions and potential legal risk and impact strategies and the availability of, and our ability to process, previously useful data, potentially exposing us to additional expense, adverse publicity, and liability.
Governments, regulators, plaintiffs' attorneys, and privacy advocates have increased their focus on how companies collect, use, store, share, transmit, and otherwise process personal data, personal information, and certain other data and information. Any perception of our practices, products, offerings, or services as violating of individual privacy or data protection rights, or failing to comply with obligations under laws or regulations relating to privacy, data protection, or cybersecurity, may subject us to public criticism, lawsuits, reputational harm, or investigations, claims, demands, or other proceedings by regulators, industry groups or other third parties, all of which could disrupt or adversely impact our business and expose us to fines, penalties, and other liabilities. Moreover, because the interpretation and application of many laws, regulations, and other actual and asserted obligations relating to privacy, data protection, cybersecurity, and the collection, use, security, and other processing of data and information are uncertain, it is possible that these laws, regulations, and obligations may be interpreted and applied in a manner that is inconsistent with our practices or the features of our products, offerings, and services. We could be required to fundamentally change our business activities and practices or modify our products, offerings, and services, any of which could require significant additional expense and adversely affect our business and results of operations, including impacting our ability to innovate, delaying our development roadmap, negatively impacting our efforts to understand our customers, limiting the effectiveness of our marketing activities, adversely affecting our relationships with customers and our ability to compete, harming our margins, and subjecting us to additional liabilities. If we are obligated to fundamentally change our business activities and practices or modify our products, offerings, or services, we may be unable to make such changes and modifications in a commercially reasonable manner, or at all, and our ability to develop new products, offerings, and services could be limited.