The roll-out of the digitized procedures for managing the exercise of data protection rights (online form, tracking tool to improve the processing of requests, etc.) continued in Fiscal 2021. This process has allowed Sodexo entities that receive a large volume of requests from data subjects (requests for access, rectification, deletion of data, etc.) to better manage and track the requests.
To ensure that any security incidents resulting from personal data breaches are properly managed, the Group Data Protection Officer and the Global Chief Information Systems Security Officer have jointly drafted a Group directive to be adapted locally by all of the Sodexo entities. A dedicated system has also been deployed in order to deal with any such security incidents even more efficiently and to enable a register of the incidents to be kept.
The Group Data Protection Officer keeps an overall register of personal data breaches, into which incidents can now be entered thanks to a simplified, automated reporting system through which the local data protection single points of contact can easily report any personal data breaches.
The overall policy and procedure for dealing with the management of data subjects’ rights were amended in Fiscal 2021 in order to better manage any data subject complaints filed with the relevant supervisory authorities or internal data protection teams.
The Group’s work on transparency during Fiscal 2021 included updating its notification templates and confidentiality policies, especially those intended for Group employees but also those including necessary information related to cookies.
A system designed to record user consent and preferences prior to the installation of cookies was deployed during Fiscal 2021 on the majority of the websites of the Sodexo entities (institutional sites and sites offering services to clients or consumers).
