We and our customers, suppliers, and other third parties with which we work rely on information technology networks and systems to manage and support a variety of business activities, including procurement and supply chain, engineering support, and manufacturing. These networks and systems, some of which are managed by third-parties, are susceptible to damage, disruptions, or shutdowns due to failures during the process of upgrading or replacing software, databases or components thereof, power outages, hardware failures, computer viruses, attacks by computer hackers or insiders, telecommunication failures, user errors, or catastrophic events. If these networks and systems suffer severe damage, disruption, or shutdown and our or third parties' business continuity plans do not effectively resolve the issues in a timely manner, our manufacturing process could be disrupted, resulting in late deliveries or even no deliveries if there is a total shutdown. This could have a material adverse effect on our reputation and we could face financial losses.
Further, we have experienced cyber-attacks, and routinely experience cyber security threats and attempts to gain access to sensitive information, as do our customers, suppliers, and other third parties with which we work. We have established threat detection, monitoring, and mitigation processes and procedures and are continually exploring ways to improve these processes and procedures. However, the scope and impact of any future incident cannot be predicted and we cannot provide assurance that these processes and procedures will be sufficient to prevent cyber security threats from materializing. Although we have not been materially impacted to date by a cyber security incident, we could experience significant operational impacts, financial or information losses and/or reputational harm in the future. Given the increasing complexity and sophistication of the tools and techniques used by threat actors, cyber-attacks can occur and persist for an extended period of time before being detected, and we may not be able to anticipate these acts or respond timely. The extent of a particular cyber incident and the steps that we may need to take to investigate the incident may not be immediately clear, and it can take a significant amount of time before an investigation of the incident can be completed and full and reliable information about the incident is known, if ever. While an investigation is ongoing, we may not know the extent of the harm caused by a cybersecurity incident or how best to remediate any harm. Moreover, new regulations may require us to disclose information about a material cybersecurity incident before it has been resolved or fully investigated. In addition, as threats continue to evolve and increase, and as the regulatory environment related to information security, data collection and use, and privacy has become and continues to become more rigorous, we have been required, and expect to continue to need to, make investments to enhance our detection, monitoring, and mitigation processes and procedures, which could adversely impact our results of operations.
If we are unable to protect sensitive or confidential information from cybersecurity threats and attacks, our customers or governmental authorities could question the adequacy of our threat mitigation and detection processes and procedures and, as a result, our present and future business could be negatively impacted. Data privacy regulations, including but not limited to the General Data Protection Regulation (EU), Data Protection Act 2018 (UK), Law No. 09-08 (Morocco), and Personal Data Protection Act 2010 (Malaysia) (collectively, "Privacy Regulations"), impose a range of compliance obligations applicable to the collection, use, retention, security, processing, and transfer of personally identifiable information. Various U.S. states and other governmental authorities around the world have imposed or are considering similar types of laws and regulations, data breach reporting and penalties for non-compliance and increasing security requirements. These laws and regulations are broad in scope and are subject to evolving interpretation and we have in the past been, and in the future could be, required to incur substantial costs to monitor compliance or to alter our practices. Moreover, these new laws and regulations could diverge and conflict with each other in certain respects. As new privacy-related laws and regulations are implemented, the time and resources needed for us to comply with such laws and regulations, as well as our potential liability for non-compliance and reporting obligations in the case of data breaches, has increased and may further increase. Violations of the Privacy Regulations may result in significant fines and sanctions. Any failure, or perceived failure, to comply with the Privacy Regulations, or any other privacy, data protection, information security, or consumer protection-related privacy laws and regulations, by us or our third parties with whom we are associated could result in financial losses and have an adverse effect on our reputation.