Moody’s privacy program

We maintain detailed records of our personal data processing operations.

We complete data privacy impact assessments to assess and mitigate potential privacy risks, adopting a privacy by design and default approach. 

We complete data transfer impact assessments to document and assess our cross-border transfers of personal data.

We execute data transfer agreements, including but not limited to EU Standard Contractual Clauses, to transfer personal data intragroup within Moody’s, on receipt from customers, and to third-party vendors. Click here to download a copy of our customer-facing EU Standard Contractual Clauses + UK + Swiss addenda.

Security is a top priority to us at Moody’s. We employ a Chief Information Security Officer and dedicated teams for information security, cybersecurity, and vendor cybersecurity. We've also implemented robust technical and organizational measures to protect personal data. Our Incident Response Management Plan involves key departments, facilitating a coordinated response. Additionally, we require vendors who process our data to sign data processing and transfer agreements and undergo privacy and security assessments.