Data privacy and security

Our ambition and objectives

We are at the beginning of a decade that will be defined by transformations to many of our global systems – energy, transport, healthcare and food – and digital technology will be central to most of these. Automation, electrification, artificial intelligence and internet of things are just a few of the areas that will accelerate rapidly. Our strategy responds to these trends and aims to deliver future-fit services that are digital, automated and data driven. Alongside the benefits of worldwide digitalization there are digital security and data protection risks to manage. Increased cyber threats and high-profile hacking cases show the need for constant vigilance across our business. We invest widely in systams and awareness raising to manage our data security and protect personal data. 

DNV is also making significant investment to support our customers in managing emergent cyber security risks. DNV provides real-world cyber security expertise to some of the world’s most complex infrastructure projects, helping customers identify their cyber risks, build powerful defence against threats, recover from attacks and win stakeholder trust and support. To read more, see The Accelerator section.

Progress in 2021

Open All Close All

• Data security

  In June 2021, we achieved Group-wide certification to the ISO 27001 standard on information security, replacing previous certifications held across different parts of the business. We also created a cyber team to enhance governance of DNV’s cyber security and software development. 

  We set up an information security risk forum in March 2021 with participants from all business areas, our Veracity IT platform, Global Shared Services (GSS) IT and Group functions. The forum works to identify, assess and mitigate information security risks and report these to the DNV risk manager as part of our quarterly risk reporting. 

  Following the arrest of a former employee on espionage charges in 2020, an information security improvement task force was immediately set up to examine potential data security breaches. The task force remained in place until mid-2021, establishing a project with the Group digital & development function to improve information classification. The project began in Q3 2021 and will continue to summer 2022 with the aim of improving information handling.

• Personal data protection

  We conducted a follow-up data protection maturity assessment with an external provider to evaluate changes from the assessment completed in 2020. Our data maturity level improved in the areas of third-party risk management, privacy training and employee awareness. 

  We also addressed data protection risks during 2021 that were identified in our personal data risk assessment from 2020. This included improving processes for retention and deletion of personal data, which had the highest risk rating. 

  A new data protection risk assessment survey was launched in 2021 to capture input from selected internal stakeholders. The outcome of the risk assessment will be used to identify and prioritize focus areas for data protection in 2022 and beyond. Areas of focus in 2021 included the consequences of the EU-US Privacy Shield invalidity, such as necessary contractual safeguards; cookie consent; prominent personal data breach cases; and interpretation of documents related to the GDPR. We also reviewed privacy statements on our websites. 

  We monitor developments in the privacy landscape by participating in relevant networks, conferences and external channels.

• Awareness and training

  Successful data protection starts with a high level of awareness and security consciousness, and we provided further data protection training for our employees in 2021. The new mandatory express training for line managers launched at the end of 2020 was completed by 90% by year-end. The training guides line managers on handling personal data and enables them to provide guidance to their teams.

  We took advantage of the international Personal Data Protection Day in January to launch a new mandatory training for all employees focused on handling personal data outside core IT systems (so-called unstructured personal data). By yearend the training had been completed by 93% of employees. 

  A personal data clean-up workshop for participants from our Finance and Legal functions was organized by the Global Data Protection Officer and Group compliance, focusing on handling and cleaning up unstructured personal data and advising on relevant practical follow-up actions. 

  COVID-19 increased the need for handling personal data related to infection and vaccination status. As a result, we took the opportunity to improve awareness related to those handling employee personal data by providing guidance on interpreting data protection law in light of COVID-19 measures. 

  For cyber security, a new wave of security awareness training was made available to all employees and associates covering emerging potential threats, such as phishing emails using COVID-19-related topics. We have also increased information sharing on cyberattack incidents using our internal Yammer social media platform. 

  A global ‘cyber and data Tuesday’ series was launched in 2021 with the aim to build security and data protection competence across DNV so that employees are equipped for tackling serious IT security and data protection threats. The series was a collaboration between Group digital & development, the Global Data Protection Officer, Group compliance and Global Shared Services (GSS) IT. Nine live sessions were delivered and recordings have been made available, reaching almost 5,500 employees in total. 

  We launched a security black-belt scheme for our software developers, where developers can advance their software security knowledge through three levels ranging from green, red and black belt. By the end of 2021, we graduated 83 green-belt software developers and seven red-belt developers. In late 2021, we also added the software tester role to the scheme’s green-belt.

• Case study - Phishing campaign

  A phishing campaign was completed in December as part of a Group internal audit. More than 4,500 employees in various DNV countries were sent a fake phishing email to test cyber security awareness levels among employees. 

  In the group who had not taken the mandatory security awareness training, 22.5% clicked on the link. This dropped to 13% for employees who had taken the training. This indicates that our training is effective at reducing employee susceptibility to phishing approaches, but that there is still a need to continuously raise cyber security awareness and to ensure all employees take the training available. In 2022 we will run quarterly campaigns and measure improvement we will also require all employees to complete a mandatory nano-learning.

Looking ahead

Open All Close All

• Data security

  Awareness of cyber security among our employees is critical. Our plans to enhance security awareness, skills and behaviour in 2022 include: training managers on data security and protection; phishing campaigns and related mandatory training throughout the year (see case study); continuing our security black-belt training for software developers and testers; adding IT infrastructure and operations roles to the black-belt training scheme and a white-belt level for non-technical roles linked to software development. 

  During 2022, employees will be subject to security vetting for specific security and digital roles.

• Personal data protection

  Personal data protection will remain in focus throughout 2022. We will improve our organizational setup for data protection with formalized roles and responsibilities; follow up on ‘Schrems-2’ ruling (including risk assessments and transfer impact assessments) and implementation of new standard contractual clauses; and update and improve DNV’s Binding Corporate Rules and internal instructions, such as access to email accounts and employee files. 

  Improvements are planned for our approach to mapping and documenting record of processing activities. Further action areas for 2022 and onwards are based on risks identified in the 2021 data protection risk assessment survey and will be followed up by each data protection manager. Examples of focus areas include retention and deletion of personal data in HR systems and managing personal data aspects within Imatis, the digital health business unit belonging to DNV’s Accelerator business area. 

  We will continue to monitor and address personal data protection in a number of areas, including: lifecycle management of applications from launch to end-of-life; new legal requirements such as those in China; improving metrics for privacy compliance; and emerging financial or reputational risks related to data protection. 

  Training and communication remain crucial to achieve awareness of personal data protection for all employees. The personal data training programme will be reviewed and updated in 2022 to deliver improved and targeted training for selected employee groups. To build on the success of the cyber and data Tuesdays sessions in 2021, a new joint awareness and training programme is being planned for security and data protection in 2022. We will also develop a new training course for new hires and integrate data protection training topics into other training initiatives in 2022.

Approach

Open All Close All

• IT and data security

  DNV employees are contractually obliged to maintain strict client confidentiality and in accordance with local laws and regulations undergo background checks before employment. 

  Our GSS IT function invests significant resources in continuously monitoring and prevent new and emerging threats or vulnerabilities to our IT systems in line with best practices. We work on the cyber-security principle of ‘assume breach’, assuming that competent and resourceful attackers will be able to break into our systems. We therefore invest resources into our ability to detect and mitigate such security breaches. 

  In partnership with our main IT vendors, IBM and Microsoft, we use machine learning to develop smarter algorithms to identify the most significant threats and detect and prevent cyberattacks. Most attack attempts on DNV are phishing or payload/malware attacks received by email. As a result, we believe that investing in employees’ cyber security awareness and competence is essential. 

  To ensure that DNV adheres to the highest level of data protection, our information security management systems are certified to the ISO 27001 information security standard across the Group. We have a detailed information classification system to segment and secure sensitive information within our IT system. We use our regular audits to check and identify opportunities for improvements. DNV’s Board of Directors reviews DNV’s cyber security risk annually. 

  Our GSS IT function operates a Computer Security Emergency Response Team that is activated during more complex and advanced cyber security situations.

• Personal data protection

  Data privacy is an essential part of ensuring legal compliance. We maintain and build our knowledge of the data protection landscape through our data protection network, training, legal advice and monitoring cases raised by data protection authorities in the countries and regions where we operate. 

  DNV’s data protection management system is part of our Group-wide compliance management system, which was set up according to ISO 37301 (in 2021 replacing ISO 19600) (see the Ethics and integrity section). Responsibility sits with the Group Compliance Officer and the Global Data Protection Officer. Data Protection Managers for each business area, GSS and selected Group units are responsible for managing risks related to data privacy, including implementing relevant mitigating actions for their units. 

  We have a comprehensive suite of policies, guidelines and instructions that set our standards for data privacy and ensure we protect the personal data of employees and customers. DNV’s new Code of Conduct includes an emphasis on the expectations of everyone involved in the business of DNV (see the Ethics and integrity section). All of our documentation and processes are aligned with, and fulfil, GDPR requirements. 

  An important enabler for data protection is training all employees, and especially those dealing with personal data as part of their daily work. 

  Customer data is handled in accordance with the confidentiality obligations outlined in the terms and conditions of our customer contracts. We are also a Binding Corporate Rules (BCR) certified company, meaning that customer and employee data can be transferred within DNV Group to countries outside the European Union and European Economic Area.