We collect and retain large volumes of data relating to our business and from our customers, independent consultants and employees for business purposes, including for transactional and promotional purposes, and our various IT systems enter, process, summarize and report such data. The integrity and protection of this data is critical to our business.
We are subject to or affected by a number of national, state and local laws and regulations, as well as contractual obligations and industry standards, that impose certain obligations and restrictions with respect to data privacy and security, and govern our collection, storage, retention, protection, use, processing, transmission, sharing and disclosure of personal information, including that of our employees, customers and others. We are also subject to requirements imposed by the payment card industry. As we expand our operations, the CCPA, CPRA, and other laws and regulations relating to privacy and data security may increase our compliance costs and potential liability. Compliance with any applicable privacy and data security laws and regulations is a time-intensive and costly process, and we may be required to put in place additional processes to comply with existing and evolving laws and regulations and new laws and regulations as we expand our operations. Many jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities and others of security breaches involving certain types of data. In addition, our agreements with certain customers may require us to notify them in the event of a security breach or incident. Such mandatory disclosures can be costly and could lead to negative publicity, penalties, fines, litigation, and other proceedings or cause our customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security breach or incident. We may not be able to monitor and react to all developments in a timely manner. Maintaining compliance with these evolving regulations and requirements could be difficult and may increase our expenses.
Many jurisdictions outside of the United States are considering or have enacted similar or more stringent legislation providing for local storage of data or otherwise imposing privacy, data protection, and data security obligations in connection with the collection, use, and other processing of personal data. Further, the global data protection landscape is rapidly evolving, and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. As our international presence expands, we may become subject to additional obligations under laws and regulations in countries outside the United States, such as, for example, the European Union's General Data Protection Regulation ("GDPR"), legislation in other countries implementing the GDPR or similar versions of the GDPR. As a general matter, compliance with laws, regulations, contractual obligations, industry standards, and any rules or guidance from self-regulatory organizations relating to privacy, data protection, and data security that apply, or are asserted to apply, to our operations may result in substantial costs and may necessitate changes to our business practices, which may compromise our growth strategy, adversely affect our ability to acquire customers, and otherwise adversely affect our business prospects, results of operations, and financial condition.
Despite the security measures we have in place to comply with applicable laws and rules and to protect our security and information systems, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures will be fully implemented, complied with, or effective in protecting our systems and information Further, our vendors and third-party service providers (as well as their third-party service providers), may be vulnerable to security breaches, acts of cyber terrorism or sabotage, vandalism or theft, computer viruses, loss or corruption of data or programming or human errors or other similar events. While we have agreements requiring our third-party service providers to use best practices for data security, we have no operational control over them. Because such attacks are increasing in sophistication and change frequently in nature, we and our third-party service providers may be unable to anticipate these attacks or implement adequate preventative measures, and any compromise of our systems, or those of our third-party vendors (as well as their third-party service providers), may not be discovered and remediated promptly. Changes in consumer behavior following a security breach or perceived security breach, act of cyber terrorism or sabotage, vandalism or theft, computer virus, loss or corruption of data or programming or human error or other similar event affecting a competitor, large retailer or financial institution may materially and adversely affect our business. While we carry cyber insurance, we cannot be certain that our coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on commercially reasonable terms or at all, or that any insurer will not deny coverage as to any future claim. Any of the foregoing may have an adverse effect on our business, prospects, results of operations, and financial condition.