Cybersecurity and Data Privacy

Our security protocols and practices ensure the protection of sensitive information and systems. We apply industry standard cybersecurity and data privacy protocols and practices throughout our systems. Our approach ensures the protection of our information, and that of our customers and others.

Cybersecurity

PPG's cybersecurity program is designed to protect and preserve the confidentiality, integrity and continued availability of all information that we own or is in our care. Our program is based on the U.S. National Institute for Standards and Technology (NIST) standards and other applicable industry standards. We regularly assess and measure ourselves against industry practices to identify opportunities to improve people, processes and technology used to identify, prevent, detect, respond and recover from cybersecurity incidents.

Our cybersecurity program includes:

• a cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident(s)
• easy-to-use tools for employees to report potential phishing emails
• annual security training for employees, including monthly phishing campaigns, cyber awareness month and onboarding awareness to ensure our employees remain vigilant and compliant with our expectations
• periodic testing of cybersecurity posture using third parties

PPG's Board of Directors has oversight of risk management at PPG, which includes cybersecurity risks. The Audit Committee of the Board is responsible for oversight of the Company's enterprise risk management (ERM) program, which provides oversight and governance of cybersecurity threats. The Audit Committee receives bi-annual reports and periodic briefings on cybersecurity matters, including key risks to PPG, recent developments, and risk mitigation activities from our vice president and chief information officer (CIO) and our chief information security officer (CISO), who are both responsible for overseeing our cybersecurity program. In addition, the full Board receives bi-annual briefings from our CIO on our cybersecurity program. The Board and the Audit Committee also periodically review the results of exercises performed by our advisors as part of an independent assessment of PPG's cybersecurity program and internal preparedness. In addition, the Enterprise Risk Committee, a committee of senior executives who identify and monitor the risks to PPG and are responsible for our ERM program, receives updated information on cybersecurity risks at each of its meetings.

We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents.

Data Privacy

Our internal data privacy policies are designed to prevent unauthorized access to, and disclosure of, personal information using a range of operational and technological safeguards. Our employees also receive training on data privacy concepts to prevent  misuse of personal information. When we share personal information with third parties, we take contractual measures to ensure such information is protected and processed in accordance with applicable laws. We closely monitor evolving data privacy and data protection legislation around the world and update our policies and procedures to comply with current regulations.

We have a global data privacy manager responsible for ensuring the ongoing compliance of PPG's data privacy and data protection policies and procedures. The manager chairs the Global Data Privacy Council, comprised of key internal stakeholders in the data privacy area and whose role is to supervise and lead compliance initiatives. The global data privacy manager reports to our chief compliance officer (CCO). The CCO oversees our data privacy program and provides regular reports to the PPG Board of Directors' Audit Committee.

Our privacy notices and statements outline how we collect, use and protect personal information provided to PPG. When personal information is no longer required, we destroy, anonymize or dispose of it using secure methods in accordance with applicable requirements.

Learn more, access our Global Data Privacy Statement and contact us at our privacy website.