Cybersecurity and Data Privacy

Our security protocols and practices ensure the protection of sensitive information and systems. We apply best practice cybersecurity and data privacy protocols and practices throughout our systems. Our approach ensures the protection of our information, and that of our customers and others.

Cybersecurity

PPG's cybersecurity program is designed to protect and preserve the confidentiality, integrity and continued availability of all information that we own or is in our care. Our program is based on the U.S. National Institute for Standards and Technology (NIST) standards and other applicable industry standards. We regularly assess and measure ourselves against industry practices to identify opportunities to improve people, processes and technology used to identify, prevent, detect, respond and recover from cybersecurity incidents.

Our cybersecurity program includes:

• ongoing employee cybersecurity awareness and training activities, which include frequent phishing testing;
• access management and access controls intended to implement Principle of Least Privilege (PoLP) access;
• protection of certain data through encryption at rest and in transit;
• monitoring and protection software;
• a vulnerability management program that includes managing the risk of third-party software;
• a cyber incident response plan that provides controls and procedures to support appropriate containment, response, investigation, reporting and recovery of cybersecurity incidents;
• periodic testing of our cybersecurity posture, including by independent third-party consultants; and
• integrating cybersecurity requirements and other provisions into various contracts.

PPG's Board of Directors has oversight of risk management at PPG, which includes cybersecurity risks. The Audit Committee of the Board is responsible for oversight of the Company's enterprise risk management (ERM) program, which provides oversight and governance of cybersecurity threats. The Audit Committee receives bi-annual reports and periodic briefings on cybersecurity matters, including key risks to PPG, recent developments, and risk mitigation activities from our vice president and chief information officer (CIO) and our chief information security officer (CISO), who are both responsible for overseeing our cybersecurity program. In addition, the full Board receives bi-annual briefings from our CIO on our cybersecurity program. The Board and the Audit Committee periodically review the results of exercises performed by our advisors as part of an independent assessment of PPG's cybersecurity program and internal preparedness. The Enterprise Risk Committee, a committee of senior executives who identify and monitor the risks to PPG and are responsible for our ERM program, receives updated information on cybersecurity risks at each of its meetings.

We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents.

Data Privacy

Our internal data privacy policies are designed to prevent unauthorized access to, and disclosure of, personal information using a range of operational and technological safeguards. Our employees also receive training on data privacy concepts to prevent the misuse of personal or confidential information. When we share personal information with third parties, we take contractual measures to ensure such information is protected and processed in accordance with applicable laws. We closely monitor evolving data privacy and data protection legislation around the world and update our policies and procedures to comply with current regulations.

We have a global data privacy manager responsible for ensuring the ongoing compliance of PPG’s data privacy and data protection policies and procedures. The manager chairs the Global Data Privacy Council, comprised of key internal stakeholders in the data privacy area and whose role is to supervise and lead compliance initiatives. The global data privacy manager reports to our chief compliance officer (CCO). The CCO oversees our data privacy program and provides regular reports to the PPG Board of Directors' Audit Committee.

Our privacy notices and statements outline how we collect, use and protect personal information provided to PPG. When personal information is no longer required, we destroy, anonymize or dispose of it using secure methods in accordance with applicable requirements.

Learn more by accessing our Global Data Privacy Statement or contact us via PPG Data Privacy Portal.