CSR And Risk Management

Data privacy is a leadership responsibility. In healthcare, trust is built long before a patient interacts with a product, a clinician, or a digital experience. It’s built in how we govern data, how we secure it, and how intentionally we decide when and how it’s used. As analytics and AI unlock powerful new ways to advance care, the obligation to protect information only grows. A few principles I believe matter most right now:  1️⃣ Privacy by design, not by retrofit. Governance and security must be embedded from the start.  2️⃣ Use data with purpose. Patient benefit should lead every decision.  3️⃣ Security is a shared responsibility. Cyber resilience relies on a culture that values continuous learning and accountability across the enterprise.  4️⃣ Transparency builds trust. Clear communication about how data is protected matters. At #JNJ, protecting patient and customer data goes hand in hand with using analytics responsibly to improve outcomes. This work is made possible by strong partnership across our technology and security teams, including leadership from Gary Harbison, our CISO at Johnson & Johnson. As our industry continues to evolve, strong data stewardship will remain one of the clear-cut indicators of trustworthy leadership. #DataPrivacyWeek #DataPrivacyDay

This isn’t an airline story. It’s a regulation story. Last week’s airline chaos is a preview of DPDP non-compliance. Rules were announced years in advance. Deadlines were clearly communicated. The intent was never a surprise. Yet when enforcement kicked in, India saw: • Thousands of flights cancelled • Passengers stranded across cities • One airline facing massive, visible reputational damage Operational issues will get fixed. Compliance gaps will close. Reputation loss is permanent memory. Now shift this lens to DPDP in India. The Digital Personal Data Protection (DPDP) Act is not upcoming news. It is already in motion. Important timelines every CXO, CISO, Founder, and business owner must note: • Data Protection Board of India is already operational • Penalties can go up to ₹250 crore for failing to protect personal data • Consent, breach reporting, security safeguards, and data principal rights go live by May 2027 This is not a legal checkbox. This is not an IT-only problem. This is a business survival issue. Airlines had time to prepare for FDTL. Some treated it seriously. Some didn’t. The outcome was chaos, government intervention, and severe brand erosion. For large enterprises, DPDP non-compliance will mean: • Regulatory scrutiny • Mandatory breach disclosures • Long-term trust erosion with customers For smaller organisations, one serious violation can mean: • Loss of customer confidence • Public exposure • Business closure DPDP is ultimately about trust. And trust, once broken, rarely comes back. If DPDP is still sitting on a future roadmap slide in your organisation, you’re already late. Solutions like Seqrite’s DPDP readiness framework are designed to help organisations move from awareness to execution early, without panic when enforcement begins. Regulations don’t hurt businesses. Unprepared businesses do. The timelines are clear. The warning signs are visible. The clock is ticking. If this resonates, forward it to the right owner in your organization before deadlines do the talking. #DPDP #DataProtection #DataPrivacy #CyberSecurity #RegTech #IndiaTech #RiskManagement #Compliance #CISO #CXO #DigitalTrust #DataGovernance #EnterpriseSecurity #InformationSecurity

CFOs are rewriting the risk register. Not because the politics changed. Because the numbers did. Carbon exposure is now quantifiable, material to valuation, and on the radar of a growing number of investors. What strikes me is that the CFOs who get this aren't treating it as a compliance problem anymore. They're turning it into a competitive advantage. Because that's exactly what it is. Climate data is reshaping capital allocation decisions from site selection, expansion to major capex. Investors are repricing portfolios through the lens of physical and transition risk. Companies that can demonstrate credible resilience are strengthening their position with customers, shareholders, and teams alike. This is a resilience conversation now. The ones that wait face higher costs later —  compliance, adaptation, supply chain — with fewer options on the table. That's why Greenly | Certified B Corp's UK launch stopped me in my tracks. They took The Economist's iconic format and rebranded it The Ecologist across the London Underground. One message: environmental intelligence belongs on the same shelf as economic intelligence. We just kept them in separate rooms for too long. Greenly didn't just launch a campaign. They closed a gap that's saved us years. Now, more than ever, we need the City’s rigour applied to climate because we are already seeing that the strongest companies aren't trying to "manage climate risk" anymore. They're using climate intelligence to run the business better. That's where resilience becomes a competitive advantage, not a cost centre. How are you seeing this shift play out? AD Image Credit: Greenly | Certified B Corp

The European Commission's 2026 study on the climate transition and public finances arrives at a conclusion that should reframe board-level thinking on sustainability risk: a net-zero trajectory is fiscally sustainable, but the path there will fundamentally restructure how governments raise and spend money. The analysis, conducted using two independent macroeconomic models across all EU member states, finds that revenues lost from declining fossil fuel taxation are more than offset by new income streams, including ETS1, ETS2, the Carbon Border Adjustment Mechanism (CBAM), and the removal of fossil fuel subsidies. The fiscal arithmetic can work. What differs is the distribution of the adjustment. Several findings demand the attention of sustainability leaders, CFOs and board audit committees. The International Monetary Fund estimates climate-related public spending could increase sovereign debt by 10 to 15% of GDP by 2050. Delayed carbon pricing adds a further 0.8 to 2% of GDP annually. For businesses operating across EU jurisdictions, sovereign fiscal stress is not an abstract risk. It translates directly into tax policy volatility, subsidy withdrawal and regulatory uncertainty. Carbon pricing alone could generate revenue equivalent to 0.9% of GDP by 2050, but tax base erosion reduces the net figure available for balancing to just 0.4% without complementary measures. Corporates relying on current tax structures to model long-range cost bases are working with assumptions that will not hold. Member states are not starting from the same position. Poland and Romania remain heavily dependent on EU financing to fund their transition, whilst Denmark and Spain are mobilising domestic public and private capital at scale. Supply chain exposure to high-dependency member states carries regulatory and operational risk that boards should be stress-testing today. The broader message is clear: the transition does not threaten fiscal stability, but it will demand active management of the revenue and expenditure shifts it triggers. Companies that treat this as background noise rather than a strategic input are accepting avoidable risk. Understanding the intersection of climate policy and financial materiality is now a core board competency. Platforms such as Plan A (plana.earth) are built to translate this regulatory and fiscal complexity into the decision-ready data that leadership needs.

Choosing between cost and sustainability? Here’s how internal carbon pricing can help you have both. I'm going to tell you a story. A few years ago, A company that was deciding between two HVAC systems for a new building. One was energy-efficient but expensive, the other cheaper but less efficient. They went with the cheaper option. Fast forward five years, and a carbon tax was introduced. Suddenly, That “cost-effective” choice became a financial burden. Sound familiar? This is where internal carbon pricing comes in. It’s not just a buzzword it’s a practical tool that helps companies make smarter, climate-conscious decisions. Why Internal Carbon Pricing? ✅ Future-Proofing: Companies can prepare for potential carbon taxes or regulations by factoring in a carbon price. ✅ Better Investments: It shifts focus from high-emission projects to low-emission alternatives. ✅ Reputation Boost: Companies that reduce emissions voluntarily stand out as sustainability leaders. ✅ Energy Savings: Even without a carbon tax, efficient choices save money on energy in the long run. The Numbers Don’t Lie → As of 2016, only 1,200 companies worldwide (about 2.5% of publicly traded firms) were using internal carbon pricing. → 83% of these companies are in countries with carbon taxes or cap-and-trade programs. → A $40/ton carbon price can make a significant difference in investment decisions, as seen in the example of choosing between a gasoline car and a hybrid. Let’s break it down with an example: The Scenario: A company is deciding between a gasoline car and a hybrid for its executives. ↳ Gasoline car: 4.7 tons of CO2/year ↳ Hybrid: 2.45 tons of CO2/year ↳ At 40/ton, the hybrid saves 40/ton, and the hybrid saves 90/year in carbon costs. The Result: While the hybrid initially seems more expensive, factoring in carbon pricing and energy savings brings it closer to breaking even. What You Can Do -Talk to Finance. -Run the Numbers. -Start Small. The question isn’t if carbon pricing will become mainstream it’s when. Companies that act now will be ahead of the curve, both financially and environmentally. What’s your take? Have you seen internal carbon pricing in action? #Sustainability #ClimateAction #CarbonPricing

What if carbon finally became a finance issue? Deloitte has just announced the launch of Sustainability Fusion, a framework co-developed with the Aspen Institute. Its ambition is clear: to translate environmental impact into cash flow so that CFOs and CSOs can finally speak the same language. The diagnosis is right. For years, sustainability has been driven by compliance reporting, while finance has focused on cash flows, profitability, and value creation. Two languages. Two time horizons. Two worlds that still struggle to connect. At Axylia | Certifiée B Corp, we started from the very same observation several years ago. But we chose a different approach. Sustainability Fusion starts with a transition project and estimates the value it could create tomorrow. It is a forward-looking, ROI-driven approach. Our approach starts from a different horizon. We begin with the EBITDA that the market already values today and deduct the carbon cost that companies do not yet recognize in their financial statements, priced in line with IPCC mitigation scenarios. In other words, we seek to measure an economic risk that already exists, even if it has not yet been reflected in financial accounts. This difference matters. To evaluate an investment with Sustainability Fusion, you need a project, a set of assumptions, and a dedicated financial model. To calculate a Decarbonized EBITDA, published financial statements are enough. A company does not need to have invested a single euro in its transition for its carbon risk exposure to become visible and directly comparable with that of its peers. Applied to the CAC 40, this analysis shows that around one-third of companies would see their entire EBITDA absorbed by their theoretical carbon bill if they had to pay the full cost of their carbon emissions. This is an insight that neither an ESG rating nor the analysis of an individual investment project can truly reveal. Seeing Deloitte invest in this area confirms a broader shift: environmental performance is becoming a financial performance issue. This is excellent news. Because, in the end, the language that truly drives organizations is the language of numbers. That conviction is what led us to create the Score Carbone Axylia®. #SustainableFinance #Sustainability #ESG #ClimateRisk #CarbonAccounting #CorporateFinance #CFO #CSO #Decarbonization #Finance #Axylia

The real risk in solar EPC isn’t the panels. It’s banks turning EPCs into unwilling lenders. Sounds dramatic, but every time I look at a project gone sideways, the technology isn’t to blame. Not the transformer stations. Not the cabeling. Not even the weather. The trouble starts before the first pile is driven. It’s the money flow, the contract payment structure, that quietly puts EPCs on the hook. Let’s break down what really happens: - There’s usually an advance payment, around 10 %, released against an Advance Payment Bond. But in practice, that money disappears quickly: design, engineering, mobilization, project overhead. - By the time procurement ramps up, for piles, cables, switchgear, transformers, the cash is already tied up. Suppliers for these material-heavy scopes typically require deposits or progress payments before shipment. Modules are easier, with longer payment terms thanks to market competition. But everything else has to be financed upfront. - So from the first weeks, the EPC is spending far ahead of income. And if you’ve ever managed one of these projects, you know the uncomfortable truth: 𝗦𝘁𝗮𝘆𝗶𝗻𝗴 𝗰𝗮𝘀𝗵-𝗳𝗹𝗼𝘄 𝗽𝗼𝘀𝗶𝘁𝗶𝘃𝗲 𝗮𝘀 𝗮𝗻 𝗘𝗣𝗖 𝗶𝘀 𝗮𝗹𝗺𝗼𝘀𝘁 𝗶𝗺𝗽𝗼𝘀𝘀𝗶𝗯𝗹𝗲. You’re constantly financing other people’s schedules, banks, clients, even subcontractors, with your own balance sheet. For the bank, that’s low risk: pay only when certified milestones are complete. For the EPC, it’s a guaranteed liquidity trap. You reach 70 % physical progress on-site. The ledger shows maybe 25–35 % received. The rest? Millions sitting in someone else’s account while the EPC covers every supplier and subcontractor. Margins in EPC are razor-thin. One delayed milestone or lender-inspection can lock up millions in cash. Add a dispute about “completion criteria,” and the whole chain freezes. The real issue isn’t bad actors. The contracts are formally correct, they mirror the lender’s schedule, built to protect bank capital, not EPC survival. I’ve seen teams execute flawlessly, on time, even early, and still lose money because payment logic didn’t match construction logic. 𝗣𝗲𝗿𝗳𝗲𝗰𝘁 𝗱𝗲𝘀𝗶𝗴𝗻. 𝗣𝗲𝗿𝗳𝗲𝗰𝘁 𝗱𝗲𝗹𝗶𝘃𝗲𝗿𝘆. 𝗘𝗺𝗽𝘁𝘆 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀. If we want sustainable execution, payment structures must follow the actual rhythm of construction, step by step, milestone by milestone, not the rhythm of a lender’s spreadsheet. Simple idea. Complex reality. And the gap keeps growing as projects scale. Your turn: How do you align payment milestones with real-world construction progress? What has actually worked in your projects? #AndreasBach #EPC #ProjectFinance

𝐆𝐃𝐏𝐑 𝐕𝐢𝐨𝐥𝐚𝐭𝐢𝐨𝐧𝐬 𝐂𝐚𝐧 𝐍𝐨𝐰 𝐀𝐦𝐨𝐮𝐧𝐭 𝐭𝐨 𝐔𝐧𝐟𝐚𝐢𝐫 𝐂𝐨𝐦𝐩𝐞𝐭𝐢𝐭𝐢𝐨𝐧: 𝐀 𝐆𝐚𝐦𝐞-𝐂𝐡𝐚𝐧𝐠𝐢𝐧𝐠 𝐃𝐞𝐯𝐞𝐥𝐨𝐩𝐦𝐞𝐧𝐭 𝐟𝐨𝐫 𝐁𝐮𝐬𝐢𝐧𝐞𝐬𝐬𝐞𝐬 A recent judgment by the Court of Justice of the European Union (CJEU) has dramatically expanded the potential consequences of violating GDPR. It's no longer simply about administrative fines or compliance burdens—now, misuse of personal data can also amount to actionable unfair competition, directly empowering competitors to take legal steps. 📌 Why is this significant? Until now, GDPR compliance was mostly seen as an internal legal and compliance matter—a cost rather than a strategic opportunity. Businesses often considered privacy rules primarily in terms of avoiding fines from data protection authorities. However, this new development shifts the landscape completely: companies misusing personal data could face lawsuits from their competitors, not just regulators. Imagine a scenario where a business unlawfully leverages user data—collected without adequate transparency or explicit consent—to gain commercial insights, better-targeted marketing, or improved customer acquisition. Such unlawful data use clearly provides an unfair competitive edge, disadvantaging competitors who diligently comply with GDPR. Under this recent CJEU ruling, those GDPR-compliant competitors now have a powerful legal tool: they can sue for unfair competition, demanding restoration of fair market conditions and potentially significant compensation for damages incurred. 📌 Strategic Implications This ruling makes GDPR compliance an essential strategic asset rather than merely a regulatory obligation. Companies investing in rigorous data protection practices not only avoid regulatory fines but also gain a competitive weapon against rivals who take shortcuts on privacy compliance. Moreover, businesses must now reconsider their entire data management strategy. The stakes are significantly higher, as non-compliance exposes them not only to regulatory penalties but also costly litigation initiated by competitors who feel commercially harmed by such practices. 📌 What should businesses do next? 1️⃣ Conduct thorough reviews of data collection processes to ensure transparency and consent. 2️⃣ Integrate data protection deeply into their competitive strategy and risk assessment. 3️⃣ Monitor competitors’ practices actively to ensure fair competition. What do you think about this new development? #GDPR #PrivacyCompliance #Ecommerce #DigitalMarketing #UnfairCompetition #LegalUpdate #DataProtection

Criminal prosecution for data protection violations just happened in the UK. I found a case from Mishcon de Reya LLP that changes everything for privacy professionals. A care home director was *criminally prosecuted* and fined £6,540 for blocking and erasing records after receiving a Data Subject Access Request. This wasn't just a civil enforcement action. Section 173 of the Data Protection Act 2018 makes it a criminal offense to alter, erase, or conceal information once a DSAR is received. The director tried multiple defenses: claiming staff provided the information, the care home manager was responsible, the company was deregistered from Information Commissioner's Office in 2016, and that the building itself wasn't a data controller. None worked. Here's what privacy leaders need to know: a. Criminal liability applies to data controllers AND individual directors and staff members. Your personal exposure goes beyond corporate fines. b. The ICO has historically focused on civil enforcement. This criminal prosecution signals a potential shift toward aggressive enforcement. c. DSAR compliance isn't just about civil penalties anymore. Prison time and personal criminal records are now possibilities for executives. Three immediate actions for your organization: 🔒 Review your DSAR response procedures to ensure no alteration or concealment occurs after requests are received. 🔒 Train directors and senior staff on personal criminal liability under section 173. 🔒 Document your DSAR handling process to demonstrate compliance and good faith efforts. This case represents the first known section 173 prosecution. It won't be the last. What's your organization doing to protect executives from personal criminal liability in data protection matters? ----- Data > Nuance. is your friendly neighborhood privacy office.

These pictures are not from a temporary scaffold. This is a real rooftop solar installation in Lucknow, Uttar Pradesh. The panels are world-class. But the structure? • Long, unsafe cantilevers • Slender, unbraced columns • Point loads on the slab • No wind resistance provisions This is not just poor design. It’s a serious safety hazard for families and neighbours. One strong storm could turn these panels into flying debris. Panels may last 25 years, but if the structure fails in 2 years, the entire system fails. A basic QC process must be made mandatory before 1) subsidy disbursal by Ministry of New and Renewable Energy (MNRE) REC Limited and 2) solar panel/inverter warranty acceptance by the manufacturers. This one step can stop malpractice and prevent not just financial loss, but potentially loss of life in the neighbourhood. As India moves ahead under PM - Surya Ghar: Muft Bijli Yojana focused on price, it’s time to bring quality and safety to the center of the conversation. Solar is not just about generation. It’s about trust. And trust begins with safety. Do you agree a mandatory QC check should be linked to subsidy release and warranty validation?