We collect and maintain information in digital form that is necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business. In the ordinary course of our business, we collect, store, and transmit confidential information, including intellectual property, proprietary business information and personal information. It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. We have established physical, electronic, and organizational measures to safeguard and secure our systems to prevent a data compromise, and rely on commercially available systems, software, tools, and monitoring to provide security for our information technology systems and the processing, transmission and storage of digital information. We have also outsourced our information technology infrastructure, and as a result a number of third-party vendors may or could have access to our confidential information. Our internal information technology systems and infrastructure, and those of our current and any future collaborators, contractors, and consultants and other third parties on which we rely, are vulnerable to damage from computer viruses, malware, natural disasters, terrorism, war, telecommunication and electrical failures, cyber-attacks or cyber-intrusions over the Internet, attachments to emails, persons inside our organization, or persons with access to systems inside our organization.
The risk of a security breach or disruption, particularly through cyber-attacks or cyber-intrusion, including by computer hackers, foreign governments, and cyber-terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. In addition, the prevalent use of mobile devices that access confidential information increases the risk of data security breaches, which could lead to the loss of confidential information or other intellectual property. The costs to us to mitigate network security problems, bugs, viruses, worms, malicious software programs and security vulnerabilities could be significant, and while we have implemented security measures to protect our data security and information technology systems, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service and other harm to our business and our competitive position. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our product development programs. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Moreover, if a computer security breach affects our systems or results in the unauthorized release of personally identifiable information, our reputation could be materially damaged.
In addition, such a breach may require notification to governmental agencies, the media, or individuals pursuant to various federal and state privacy and security laws, if applicable, including the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Clinical Health Act of 2009, and its implementing rules and regulations, as well as regulations promulgated by the Federal Trade Commission and state breach notification laws.
Under the EU regulation and notably the General Data Protection Regulation, or GDPR, No. 2016/679, which entered into force on May 25, 2018 and is applicable personal data that we process in relation to our presence in the EU, the offering of products or services to individuals in the EU or the monitoring of the behavior of individuals in the EU, we have also a legal responsibility to report personal data breaches to the competent supervisory authority. The EU data protection regulation includes a broad definition and a short deadline for the notification of personal data breaches, which may be difficult to implement in practice and requires that we implement robust internal processes. Under this regulation, we must report personal data breaches to the competent supervisory authority within 72 hours of the time we become aware of a breach "unless the personal data breach is unlikely to result in a risk to the right and freedoms of natural persons" (Article 33 of the GDPR). In addition, the GDPR requires that we communicate the breach to the Data Subject if the breach is "likely to result in a high risk to the rights and freedoms of natural persons" (Article 34 of the GDPR). In order to fulfill these requirements, we have to implement specific internal processes to be followed in case of a personal data breach, which will allow us to (a) contain and recover the breach, (b) assess the risk to the data subjects, (c) notify, and possibly communicate the breach to the data subjects, (d) investigate and respond to the breach. The performance of these processes implies substantial costs in resources and time.
Moreover, as we may rely on third parties that will also process as processor the data for which we are a data controller-for example, in the context of the manufacturing of our drug candidates or for the conduct of clinical trials, we must contractually ensure that strict security measures, as well as appropriate obligations including an obligation to report in due delay any security incident are implemented, in order to allow us fulfilling our own regulatory requirements.
We would also be exposed to a risk of loss or litigation and potential liability for any security breach on personal data for which we are data controller. The costs of above-mentioned processes together with legal penalties, possible compensation for damages and any resulting lawsuits arising from a breach may be extensive and may have a negative impact on reputation and materially adversely affect our business, results of operations and financial condition.