We have access to, collect, or maintain private or confidential information regarding our customers, associates, and suppliers, as well as our business. The protection of our customer, associate, supplier, and company data is critical to us. In recent years, there has been increasing regulation, enforcement, and litigation activity in the area of privacy, data protection, and information security in the United States and in various other countries, with the frequent imposition of new and changing requirements across the many states in which we conduct our business. State privacy laws and regulations, such as The Connecticut Data Privacy Act, the New York Privacy Act, and The California Consumer Privacy Act of 2018, and others, have imposed and likely will impose additional data protection obligations on companies considered to be doing business in such applicable states and provides for substantial fines for non-compliance and, in some cases, a private right of action to consumers who are victims of data breaches. Complying with existing laws and similar emerging and changing privacy, data protection, and information security requirements may cause us to incur substantial costs or compliance risks due to, among other things, system changes and the development of new processes and business initiatives. Our failure to comply with privacy, data protection, and information security laws could result in potentially significant regulatory and/or governmental investigations and/or actions, litigation, fines, sanctions, ongoing regulatory monitoring, and customer attrition.
In addition, our customers have a high expectation that we will adequately protect their personal information from cyber-attack or other security breaches. We have procedures in place to evaluate the integrity of our systems, and to safeguard such data and information. However, the landscape is evolving at a rapid pace, and we may be unable to effectively anticipate or respond to attacks to or breaches of our security systems or implement adequate preventative measures. A breach of customer, employee, supplier, or company data could attract a substantial amount of negative media attention, damage our customer and supplier relationships and our reputation, and result in lost sales, costly fines, other expenses, and/or lawsuits, any of which could have a material adverse effect on our business, financial condition, and results of operations.