whichever is higher. Further, Brexit has created uncertainty with regard to the regulation of data protection in the U.K. As of the beginning of 2021 (when the transitional period following Brexit expired), data processors and controllers are required to comply with the GDPR as well as the U.K. equivalent, which exposes us to two parallel data protection regimes in Europe, each of which potentially authorizes similar fines and other potentially divergent enforcement actions for certain violations. Additionally, recent legal developments in Europe have created complexity and uncertainty regarding transfers of personal information from the EEA and the U.K. to the United States and other jurisdictions, which could lead to additional costs, complaints, and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services or the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.
Furthermore, in the United States several state legislatures have passed comprehensive Privacy Laws, which have gone into effect or will soon go into effect, including the California Consumer Privacy Act, which was further expanded by the California Privacy Rights and Enforcement Act of 2020, or CPRA, which took effect in most material respects on January 1, 2023 (with application to data collected beginning on January 1, 2022), as well as forthcoming laws in Colorado, Connecticut, Utah and Virginia. In addition, the U.S. Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data. Such standards require us to publish statements that describe how we handle personal data and choices individuals may have about the way we handle their personal data. Further, laws in all 50 U.S. states, the District of Columbia, and several U.S. territories can require businesses to provide notice to consumers whose personal data has been disclosed as a result of a data breach. Each of these broadly impacts businesses that handle various types of personal data, potentially including the Manager and its affiliates.
Portfolio companies are subject to Privacy Laws in the jurisdictions in which they operate. Compliance with current and future Privacy Laws could significantly impact current and planned privacy and information security related practices, the collection, use, sharing, retention and safeguarding of personal data and some of our current and planned business activities and as such could increase costs for the Company and/or portfolio companies. Although the Company, the Manager and KKR intend to make reasonable efforts to comply with all Privacy Laws, we may not be successful in complying with the rapidly evolving privacy, data protection, and security requirements discussed above. Further, there can be no assurance that we will not be subject to regulatory or individual legal action, including fines, in the event of a security incident or other claim that a consumer’s privacy rights have been violated. Any actual or perceived failure to comply with our posted privacy policies, Privacy Laws, or any other legal obligations, such as contractual obligations, relating to privacy, data protection, security, breach notification or consumer protection, could result in regulatory scrutiny and increased exposure to the risk of litigation or the imposition of consent orders, resolution agreements, requirements to take particular actions with respect to training, policies or other activities, and civil and criminal penalties, including fines and damages, which could have an adverse effect on our business, reputation, results of operations or financial condition. In addition, we could be required to fundamentally change our business activities and practices or modify our solutions and services, which could have an adverse effect on our business, results of operations or financial condition. Any of the foregoing could result in additional cost and liability to us, damage our reputation, inhibit sales, and adversely affect our business, results of operations or financial condition.
Cybersecurity risks could result in the loss of data, interruptions in our business and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations.
In the ordinary course of our business, we may collect, process, and store proprietary, confidential, and sensitive information, including personal information, intellectual property, trade secrets, and proprietary business information owned or controlled by ourselves or other parties. It is critical that we do so in a secure manner to maintain the confidentiality, integrity, and availability of such information. We face several risks
81