Governance
Implementation Framework for Personal Information Protection and Privacy
NEC has appointed a Chief Legal Officer (CLO) as the corporate officer in charge of personal information protection, and has established the position of Personal Information Protection Administrator as well as the Personal Information Protection Promotion Office to promote personal information protection at the corporate level.
As the person in charge of implementing the personal information protection management system, the head of the department responsible for protecting personal information serves as the Personal Information Protection Administrator. This person is also responsible for protecting specific personal information related to the Numbers to identify a specific individual in administrative procedures (Individual Number which is called My Number).
The Corporate Legal Department plays a central role in promoting the protection of personal information within the NEC Group under the leadership of the Personal Information Protection Promotion Office Manager appointed by the Personal Information Protection Administrator, and reports the status of operations related to the protection of personal information to the Board of Directors at least once a year.
In the Group Internal Audit Division, this is handled by the Chief Personal Information Protection Auditor, who conducts regular internal audits of personal information protection in conformance with Japanese Industrial Standard JIS Q 15001 (Personal information protection management systems—Requirements).
The managing directors of each department are responsible for directing personal information protection in their respective departments. Each managing director appoints a Personal Information Protection Administrator, who is responsible for carrying out personal information protection management for the department, and a Personal Information Protection Professional, who provides specialized expertise in personal information protection. The personal information protection management system operates based on each division’s inspection of the status of personal information handling to identify risks, including human rights and privacy issues, and improvement in handling rules based on the inspection results.
The person responsible for each project ensures that persons who handle personal information undertake thorough personal information protection measures.
1. Privacy Mark
In October 2005, NEC Corporation received Privacy Mark certification, recognizing it as a business operator with systems in place to ensure appropriate protection measures for personal information in conformance with JIS Q 15001.
2. Consolidated Subsidiary Management Framework
Our consolidated subsidiaries in Japan have built systems to comply with the Act on the Protection of Personal Information and the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (also known as the My Number Act). In addition, just as NEC Corporation does, they promote personal information protection by building a personal information protection management system to conform with JIS Q 15001. As of the end of March 2026, 28 NEC Group companies (in Japan) have obtained Privacy Mark certification.
At our consolidated subsidiaries outside Japan, we have appointed a Personal Information Protection Administrator at each major subsidiary to promote the protection of personal information. In addition, we have established common personal information protection guidelines and introduced personal information protection rules that comply with the laws and regulations of each country and region applicable to each company, such as personal information protection laws.
Strategy
Risks and Opportunities Related to Privacy
The principal risks and opportunities identified by NEC for this theme are as follows:
“Responsible Privacy Protection to Ensure Appropriate Data Value Creation”
1. Impact on the Environment and Society
1.1. Negative Impact
Leakage of personal data collected from cloud-based services, etc.
1.2. Positive Impact
Enable people to enjoy the benefits of new solutions utilizing personal data.
2. Financial Risks and Opportunities
2.1. Risks
If a significant personal information leak incident is caused, the impact will be large.
2.2. Opportunities
Provide new services that generate revenue by using customers’ information for innovation.
Risk Management
Policy on Personal Information Protection and Privacy
The NEC Group Code of Conduct stipulates respect for human rights and privacy and the management of personal information, and NEC has positioned “Provision and Utilization of AI with Respect for Human Rights as the Highest Priority (AI and Human Rights),” including personal information protection initiatives, as a priority management theme from an ESG perspective—materiality. From this perspective, we are tackling prevention of any privacy-related issues stemming from the handling of personal information, in addition to undertaking other personal information protection measures.
The NEC Privacy Policy stipulates that personal information must be handled in accordance with JIS Q 15001.
Consolidated subsidiaries in Japan set their personal information protection policies using NEC Corporation’s Privacy Policy as the standard.
Consolidated subsidiaries outside Japan set their policies to conform with the applicable local laws of their respective countries, and those policies are then checked by the Company.
Personal Information Protection and Management Initiatives
1. Internal Initiatives
1.1. Personal Information Protection Management System
We operate a personal information protection management system based on documented standard procedures at NEC Corporation and its consolidated subsidiaries in Japan. As necessary, operational rules are created at the individual company and department level and by type of personal information, and strict adherence is enforced.
In addition, the personal information management manual for our personal information protection management system stipulates the following:
- When handling personal information, specify the purpose of use as concretely as possible.
- When obtaining personal information from sources including documents, email, and websites, the person to whom the information pertains must be notified in advance in writing and the person’s consent must be obtained in writing.
- Use for purposes other than the specified purpose (use for other purposes) is prohibited.
- When providing personal information, the consent of the person to whom the information pertains must be obtained, except in cases required by law.
- Security control measures of personal information must be taken.
- Secondary use of personal information without the prior consent of the person to whom the information pertains is prohibited.
- The rights of the person to whom the information pertains, including the rights to access, amend and delete their personal information, must be respected.
In addition, we also enter into agreements with third parties with whom we share or to whom we entrust the handling of data, stipulating that the above rules must be observed. We have established escalation rules and emergency response procedures in the event of a leak or inappropriate handling of personal information.
1.2. Management of Personal Information
NEC Corporation runs the Personal Identifiable Information Control System, a ledger-based system to manage personal information and make its management more transparent.
We create personal information management ledgers at each consolidated subsidiary outside Japan to gain an understanding of the content of personal information being handled and the risks involved. We also work to ensure that the procedures to manage these contents and risks, as well as common security control measures that need to be observed, are thoroughly disseminated.
1.3. Initiatives to Address Cross-border Transfers of Personal Information
We require consolidated subsidiaries outside Japan to obtain individual consent based on the laws and regulations in each country or region to facilitate any cross-border transfer of personal information for employees or otherwise enter into any required data transfer contracts to enable cross-border transfer and processing of personal information between Group companies in and outside Japan.
2. Initiatives for Customers and Business Partners
When outsourcing the handling of personal information, NEC Corporation and its consolidated subsidiaries in Japan establish security control measures for contractors according to the risk involved, stipulate in agreements with contractors with which data is shared that they must comply with these measures, requiring privacy management equivalent to that of the NEC Group.
We request the contractors engaged in work for NEC Corporation or its consolidated subsidiaries in Japan submit a pledge on the Basic Rules for Customer-Related Work to help ensure rigorous management of personal information throughout the supply chain.
We require that Numbers to identify a specific individual in administrative procedures (Individual Number which is called My Number) be handled with the utmost care and be managed with strict security measures, as it is classed as Specific Personal Information in compliance with personal information protection laws in Japan. We deploy technical measures such as controlling access, blocking unauthorized external access, and preventing information leaks, while moving forward with initiatives to maintain sufficient privacy protection levels in each system.
Information Security and Cybersecurity
3. Monitoring and Improvement
NEC Corporation appropriately manages personal information by executing plan–do–check–act (PDCA) cycles on an autonomous basis through various inspection activities.
Also, NEC Corporation and its consolidated subsidiaries in Japan conduct regular internal audits based on internal audit check items stipulated in JIS Q 15001. Furthermore, for operations related to the handling of Numbers to identify a specific individual in administrative procedures (Individual Number which is called My Number), we use security control measure checklists prepared based on Japan’s guidelines for the My Number Act and self-checklists for re-entrustment in order to monitor the divisions and subcontractors that handle My Number information.
3.1. Verification of the Operation of Information Security Control Measures
The implementation status of information security control measures carried out by all employees is verified once a year. If there are cases of non-compliance, improvement plans are formulated and carried out at the organization level.
3.2. Verification of the Status of Personal Information Management
Control forms registered in the Personal Identifiable Information Control System are reviewed at least once a year to confirm the status of personal information management.
The managing director of each division confirms the management status of their division through an annual management review, and if new risks become clear, addresses them and maintains appropriate management conditions.
3.3. Verification of Operations During Emergencies
In the event of an incident involving the loss, outflow or leak, etc., of personal information, operation of the above information security control measures is thoroughly reviewed as needed. In addition, depending on the case, we deploy response measures to each division and Group company and work to prevent incidents and accidents across the entire Group.
4. Details of Personal Information Protection-related Incidents, Accidents, or Complaints, and Measures Taken
In fiscal year 2026, there were no incidents involving the loss, outflow or leak, etc., of personal information at NEC that would significantly impede our business operations, and no incidents involving secondary use of personal information without prior consent of the person to whom the information pertains.
There were no external complaints regarding personal information in fiscal year 2026.
We have not received any claims or complaints regarding invasion of the privacy of customers from any third-party organizations, including the Ministry of Economy, Trade and Industry, which is the competent government agency, and the Personal Information Protection Commission of Japan.
5. Response to Requests from National Governments for Personal Information Provision
If NEC Corporation’s departments are requested by a government or law enforcement agency of a country to provide personal information that the Company holds, the seneior director of the department that receives the request reports to and consults with the Personal Information Protection Administrator as necessary. In such cases, the Personal Information Protection Administrator reports to and consults with the corporate officer in charge of personal information protection. Premised upon respect for the human rights of the person to whom the information pertains, the Company will then determine the necessity of providing such information and undertake the appropriate procedures and measures pursuant to the applicable laws and regulations. There were no requests from government or law enforcement agencies for personal information held by NEC in fiscal year 2026.
Privacy in Business Activities
Privacy protection laws and regulations such as the General Data Protection Regulation (GDPR), which came into effect in the European Economic Area in 2018, are being established in many countries and regions, and the roles and responsibilities required of companies to protect privacy are increasing as enforcement of these laws and regulations becomes more stringent.
NEC Corporation aims to maximize social value and minimize the adverse impact on society by developing and providing products and services with consideration for privacy issues, which may be perceived differently depending on the country, region or culture, and also with consideration for discrimination and other human rights issues that could be exacerbated by AI utilization. To clarify our stance, the NEC Group Code of Conduct and the NEC Group AI and Human Rights Principles (the Company-wide Principles) stipulate that business activities aimed at resolving social issues using ICT must not give rise to human rights issues, including invasion of privacy.
As stated in the description of management systems of consolidated subsidiaries, NEC Corporation and its 28 Group companies in Japan have acquired Privacy Mark certification.
In principle, without the prior consent of the person to whom the information pertains, we forbid the acquisition of information that could have an economic impact such as bank account or credit card numbers, sensitive information such as one’s birthplace, or highly private information such as mobile telephone numbers.
Respect for Human Rights
AI and Human Rights
NEC Group AI and Human Rights Principles
Response in an Emergency Such as Leakage of Personal Information
The Company maintains systems that enable it to respond swiftly and disclose information if an incident occurs involving the loss, outflow or leak, etc., of personal information. If an incident should occur, the response is coordinated quickly and systematically based on standardized procedures.
If an incident occurs related to personal information or an event takes place for which the occurrence of such an incident is a possibility, the discoverer or the employee involved in the incident contacts the manager of each division and the NEC Group contact desk for information security incidents.
The person at the contact desk who received the report then takes actions in coordination with the Personal Information Protection Promotion Office and relevant divisions, in accordance with applicable laws, ordinances, ministry guidelines, and other regulations, while considering the risk of infringing on the rights and interests of the people involved. These responses may include promptly notifying the people involved, making a public announcement, and taking corrective measures appropriate to the incident.
Personal Information Protection Training and Awareness-Raising
To raise awareness of personal information protection and information security in general among employees, the Basic Rules for Handling Customer-Related Work and Trade Secrets have been established, and NEC Corporation rigorously disseminates these rules.
Various training is also provided to all employees.
1. Training for All Corporate Officers and Employees Including Dispatched Workers (NEC Corporation)
The Company conducts web-based information security training including personal information protection once a year. The completion rate of company-wide training was 97.1% in fiscal year 2026.
2. Education for Personal Information Protection Professionals (NEC Corporation, All Departments)
The following education is provided for Personal Information Protection Professionals.
- Textbooks, multiple-choice comprehension tests, and descriptive assignments have been prepared on risk management in the handling of personal information, in addition to education through 15 lectures
- Courses aimed at acquiring personal information protection qualifications
- Conducted improvement training (9 sessions) on issues extracted from actual case examples
3. Training for Graduates and Mid-career Hires (NEC Corporation and Its Consolidated Subsidiaries in Japan)
In fiscal year 2026, we created a PDF booklet on personal information protection as introductory training material, and distributed it.
When a request is received from a department, or when it is otherwise deemed necessary by the Personal Information Protection Promotion Office, awareness training is conducted at individual departments or consolidated subsidiaries in Japan.
Metrics and Targets
FY2031 KPIs
(Scope: NEC Corporation unless otherwise specified, Period: April 2026 to March 2031)
M: Indicates the main non-financial targets related to materiality.
M: Appropriate operation (including annual employee training and the oversight of contractors) and improvement of our Personal Information Protection Management System
M: Zero incidents of serious personal information leaks
FY2027 Goals
1.1. Strengthen Governance in the Fields of Data Privacy and Compliance
- Continue to implement monitoring of personal information protection at consolidated subsidiaries in and outside Japan
- Continue to provide training for all employees including those of consolidated subsidiaries in and outside Japan
- Ensure that the operation of management systems equivalent to ours by appointing Personal Information Protection Administrators and Personal Information Protection Professionals at consolidated subsidiaries in Japan becomes established
- Promote visualization and risk reduction of personal information protection risks by organization (each department and consolidated subsidiaries in and outside Japan)
1.2. Deepen Risk Management Pertaining to the Handling of Personal Information, Based on the Risk Ownership of Managing Director
- Continue the training and education of Personal Information Protection Administrators and Personal Information Protection Professionals assigned to all departments
- Continue to implement training for Personal Information Protection Promotion Office staff at consolidated subsidiaries in Japan and staff in charge of personal information protection at consolidated subsidiaries outside Japan
FY2026 Goals and Results
1. FY2026 Goals
1.1. Strengthen Governance in the Fields of Data Privacy and Compliance
- Continue to implement monitoring of personal information protection at consolidated subsidiaries in and outside Japan
- Continue to provide training for all employees including those of consolidated subsidiaries in and outside Japan
- Continue to establish management systems equivalent to ours by appointing Personal Information Protection Administrators and Personal Information Protection Professionals at all consolidated subsidiaries in Japan
1.2. Deepen Risk Management Pertaining to the Handling of Personal Information, Based on the Risk Ownership of Managing Director
- Continue the training and education of Personal Information Protection Administrators and Personal Information Protection Professionals assigned to all departments
- Implement training for staff in charge of personal information protection at consolidated subsidiaries in and outside Japan
2. FY2026 Results
2.1. Strengthen Governance in the Fields of Data Privacy and Compliance
- Implemented monitoring of personal information protection at consolidated subsidiaries in and outside Japan
- Provided training for all employees including those of consolidated subsidiaries in and outside Japan
- Newly introduced management systems equivalent to ours in consolidated subsidiaries in Japan (2 subsidiaries and 1 sub-subsidiary)
2.2. Deepen Risk Management Pertaining to the Handling of Personal Information, Based on the Risk Ownership of Managing Directors
- Provided education for Personal Information Protection Administrators and Personal Information Protection Professionals
- Provided information on topics and practical tools related to the protection of personal information for Personal Information Protection Administrators and Personal Information Protection Professionals