please determine if this risk can impact the Budgeting and Standard Cost Systems and/or the Capital Investment Analysis. please describe what management could do to minimize the stated risk.

1. If we or our franchisees or licensees are unable to protect our consumers payment card data and other regulated, protected or personally identifiable information, we or our franchisees could be exposed to data loss, litigation, and liability, and our reputation could be significantly harmed. Our business requires the collection, transmission, and retention of large volumes of consumer and employee data, including credit and debit card numbers and other personally identifiable information, in various information technology systems that we and our franchisees maintain, and in those maintained by third parties with whom we contract to provide services. The integrity and protection of that guest and employee data is critical to us. Any failure to comply with legal and industry rules and/or requirements could significantly harm our brand, reputation, business, and results of operations. We also rely on independent service providers for payment processing, including credit and debit cards. If these independent service providers become unwilling or unable to provide these services to us or if the cost of using these providers increases, our business could be harmed. We are, and may increasingly become, subject to other various laws, directives, industry standards and regulations, as well as contractual obligations, relating to data privacy and security in the jurisdictions in which we operate. The information, security and privacy requirements imposed by governmental regulation are increasingly demanding. In the U.S., various federal and state regulators, including governmental agencies like the Consumer Financial Protection Bureau and the Federal Trade Commission, have adopted, or are considering adopting, laws and regulations concerning personal information and data security and have prioritized privacy and information security violations for enforcement actions. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal information than federal, international or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts. State laws are changing rapidly and there is discussion in Congress of a new comprehensive federal data privacy law to which we would become subject if it is enacted, which may add additional complexity, variation in requirements, restrictions and potential legal risks, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs or changes in business practices and policies. We are also subject to international laws, regulations and standards in many jurisdictions, which apply broadly to the collection, use, retention, security, disclosure, transfer and other processing of personal information. For example, the General Data Protection Regulation (GDPR), which was adopted by the European Union effective May 2018, includes obligations and restrictions concerning data transparency and consent, the overall rights of individuals to whom the personal data relates, the transfer of personal data out of the European Economic Area (EEA) or the U.K., security breach notifications and the security and confidentiality of personal data. The GDPR authorizes fines for certain violations of up to 4% of global annual revenue or 20 million, whichever is greater. Further, the U.K.s decision to leave the European Union has created uncertainty with regard to data protection regulation in the U.K. We are also subject to the U.K. GDPR and U.K. Data Protection Act of 2018, which retains the GDPR in the U.K.s national law. Our failure to adhere to or successfully implement appropriate processes to adhere to international data privacy requirements could expose us and our franchisees to financial penalties and legal liability. Our and our franchisees systems may not be able to satisfy changing requirements and guest and employee expectations or may require significant additional investments or time to do so. Because the interpretation and application of laws, regulations, standards, and other obligations relating to data privacy and security are still uncertain, it is possible that these laws, regulations, standards, and other obligations may be interpreted and applied in a manner that is inconsistent with our data processing practices and policies. If our practices are not consistent, or are viewed as not consistent, with changes in laws, regulations and standards or new interpretations or applications of existing laws, regulations, and standards, we may also become subject to fines, audits, inquiries, whistleblower complaints, adverse media coverage, investigations, lawsuits, loss of export privileges, severe criminal or civil sanctions, or other penalties. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other statements that provide promises and assurances about data privacy and security can subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual practices. Any concerns about our data privacy and security practices, even if unfounded, could damage the reputation of our businesses and discourage potential users from our products and services. Any of the foregoing could have an adverse effect on our business, financial condition, results of operations, and prospects.