Compliance Wheel (English Ver.)

What were the consequences for the employee involved and the CBU?

• The employee received a formal warning.

• Extensive compliance trainings were conducted in the CBU.

• The case was reported via the official whistle blowing line of the company, the Danone Ethics Line (DEL).

• All of the above.

How would you manage this situation?

• Go ahead because you can objectively substantiate, in writing, why the agency is a good fit for Danone.

• Put your friend’s agency in contact with Danone, but immediately disclose the situation in writing to your N+1 and step out of the selection process.

• You can’t proceed because they are a friend, and this will cause a conflict of interest.

How could this situation be prevented?

• During vacation or absenteeism, every payment request needs confirmation by phone from N+1.

• Implementing clear delegation procedures that accommodate vacations and absenteeism, without losing segregation of duties.

• Ensuring that each supplier acknowledges the process of Danone’s Third-Party Vetting (TPV) procedure.

Can you store Danone’s information on a third-party server?

• Yes, if a third-party legally protects the information and complies with all the applicable regulations.

• Yes, if an appropriate assessment is done involving Danone’s IT, General Secretary and other relevant departments.

• No, you cannot store Danone’s information on a third-party server.

Why is this an issue?

• HCPs do not want this information to be easily accessible for their patients.

• Proactive communication about our infant formula to consumers is seen as promotion, which interferes with our conviction to protect and support breastfeeding.

• There is a difference in GDPR regulation when we target HCPs and consumers.

• All of the above.