This metric is based on the Global Reporting Initiative (GRI) Standard Guidelines. 

GRI 418 addresses the topic of customer privacy, including losses of customer data and breaches of customer privacy. These can result from non-compliance with existing laws, regulations and/or other voluntary standards regarding the protection of customer privacy. 

To protect customer privacy, an organization is expected to limit its collection of personal data, to collect data by lawful means, and to be transparent about how data are gathered, used, and secured. The organization is also expected to not disclose or use personal customer information for any purposes other than those agreed upon, and to communicate any changes in data protection policies or measures to customers directly.

The disclosures in this Standard can provide information about an organization’s impacts related to customer privacy, and how it manages them.

In 2018, the GRI G4 Sustainability Reporting Guidelines were superseded by the GRI Sustainability Reporting Standards (GRI standards). For this metric, the code G4-PR8 is used in company reporting prior to 2018, and the new GRI 418-1 code used in reporting from 2018 onwards. The methodology for the former G4 standard for this metric can be found here.