Danone // 2020 Universal Registration Document

2 Overview of activities, risk factors 2.6 Risk factors DANONE UNIVERSAL REGISTRATION DOCUMENT 2020 31 Operational risks DESCRIPTION MANAGEMENT MEASURES medium Cybersecurity Danone’s success depends on continuous, uninterrupted availability of its information technology systems, notably to process transactions and to manage stocks, purchases and deliveries of its products. In a fast-evolving environment, Danone needs to evolve towards a data enabled organization in order to reach customers more rapidly with products and services adapted to their needs. In this context of digitalization, the frequency and sophistication of cyberattacks & other data breaches are increasing and may result in an increase in Danone’s exposure to risks such as: • hacking of physical facilities (plants, security systems, electric doors, etc.); • leakage of the Company’s confidential data; • cyber fraud & ransomware attacks. The Covid-19 pandemic has required all organizations, including Danone, to adapt and embrace social distancing and remote working. It has given rise in the number of cybersecurity incidents including high-profile public malware and ransomware attacks, as attackers use Covid-19 as bait to mislead customers and consumers. This increases the risk and adds challenging operational issues to the task of responding to the pandemic. Any breach of IT security resulting in low/reduced data integrity, system failure, loss of data, proprietary or otherwise, may result in high costs and/or multiple impacts for Danone and its subsidiaries, including disruption of production and sales, inaccurate financial reporting, theft of strategic data, regulatory fines, and reputational damages with stakeholders, ultimately impacting Danone’s financial results. Danone has integrated in its global strategy, action plans to tackle possible identified weaknesses and improve its security systems and processes regarding “identify, protect, detect, respond and recover” elements around cyberattacks. Danone is embedding the U.S. Commerce Department’s National Institute of Standards and Technology’s (NIST) industry framework to structure these efforts. Moreover, Danone is activelyworking on 5 areas of cyber riskmitigation: • user awareness: building more awareness through communi- cation & training; • industrial sites: protecting the Company against industrial site attacks; • local infra and shadow IT: major infrastructures or Cloud services are hosted by global specialists; • digital applications: streamlining & standardizing digital appli- cations; • safe workplace solutions for its employees.