Our Code of Conduct for Suppliers defines the values and requirements we place on our business partners in the course of our business activities. Compliance with and implementation of the principles set out in the Supplier Code of Conduct is essential for all our business relationships.
As the supply chain of NTT DATA Business Solutions AG (hereafter “NDBS” or “we”) has become more global and complex in recent years, it has become a crucial issue for us to respond appropriately to global issues including disasters, pandemics, the environmental, human rights, and security.
In these circumstances, based on our procurement policies, with concern for the attitude and responsibilities of our supply chain, we have restructured our existing Code of Conduct for Suppliers. By requesting that our suppliers follow this Code of Conduct for Suppliers, we hope to realize a sustainable supply chain, and by extension realize a sustainable society.
[Procurement Policies]
Modern supply chains are rapidly becoming more global and complex, and it has become critical issue for us to respond to global problems involving human rights, ethics, the environment, disasters, pandemics, and security. In response to these issues, NDBS intends to contribute independently and proactively to the realization of a sustainable society. We will do this by deepening mutual understanding and building relationships of trust with all suppliers that comprise our supply chain. Furthermore, we will continue to work with all our suppliers toward building and maintaining a safe and secure supply chain, including protecting human rights and conserving the global environment, based on our high ethical standards.
This Code of Conduct for Suppliers describes matters that each company comprising our supply chain should actively address in order to realize a sustainable society. In this Code of Conduct for Suppliers, the term “suppliers” refers to any business entity that provides products, people, or services to NDBS. Requirements described this Code of Conduct for Suppliers applies to all suppliers with whom we have direct transactions. One responsibility of suppliers with whom we have direct transactions to communicate the contents of this Code of Conduct for Suppliers to other suppliers who constitute their upstream supply chain and promote their compliance with this Code of Conduct for Suppliers, as well as confirm their compliance status, based on contracts (In this Guidelines, “other suppliers who constitute their upstream supply chain” means our suppliers’ suppliers and subcontractors).n this Code of Conduct for Suppliers applies to all suppliers with whom we have direct transactions. One responsibility of suppliers with whom we have direct transactions to communicate the contents of this Code of Conduct for Suppliers to other suppliers who constitute their upstream supply chain and promote their compliance with this Code of Conduct for Suppliers, as well as confirm their compliance status, based on contracts (In this Guidelines, “other suppliers who constitute their upstream supply chain” means our suppliers’ suppliers and subcontractors).
NDBS may conduct audits to confirm that all suppliers are implementing the matters requested of them in this Code of Conduct for Suppliers. To that end, NDBS may require suppliers to disclose necessary information. We ask that suppliers guarantee the accuracy and completeness of such information, and to provide it without delay. When actions or events that do not satisfy the matters described in this Code of Conduct for Suppliers is identified through an audit or the like, NDBS will request all suppliers to make improvements. If no improvements are made, then we will take appropriate measures, including canceling transactions.
If NDBS Group companies establish their own guidelines other than this Code of Conduct for Suppliers, or if requests are made, which differ from this Code of Conduct for Suppliers due to the laws of the countries where NDBS group companies are located, or ordinances and rules of local governments, or requests from customers, then priority shall be given to the guidelines of each group company.
We ask our suppliers to understand and support NDBS’s procurement policies and sustainable supply chain initiatives, as well as cooperate with active promotion of this Code of Conduct for Suppliers.
March 2022
NTT DATA Business Solutions AG
Corporate Compliance Department
(Common – I) Build management systems
To build a management system refers to build a system for continuous improvement through PDCA (Plan-Do-Check-Action), with regard to policy compliance, implementation systems, corrective actions, and stakeholder engagement. This does not aim for or mean obtaining certification. Below are some things to bear in mind when building a management system.
In addition, a management system includes:
The following typical management systems exist for each individual matter.
< Occupational Health and Safety > ILO Guidelines on Occupational Safety and Health Management Systems, OHSAS 18001, ISO 45001, etc.
< Environment > ISO 14001, EMAS, Eco Action 21, Eco Stage, etc.
< Product Quality and Safety > ISO 9000 Family, IATF 16949, ISO 13485, etc.
< Information Security > ISO/IEC 27001, ISO 20243, SOC 2, IEC 62443, security-related NIST documents, etc.
< Business Continuity Plans > ISO 22301, etc.
(Common – 2) Detect inappropriate activities early by building complaint processing mechanisms
A complaint processing mechanism is a mechanism with which relevant parties can report on and urge corrections be made regarding any actions that are suspected of violating this Code of Conduct for Suppliers. When lodging complaint processing, it must be possible to do whistleblowing anonymously. In complaint processing, whistleblowers must not be treated disadvantageously. For example, this includes use of comment boxes, telephone, email, or a whistleblowing service using an external organization, etc. In order for complaint processing mechanisms to function effectively, it is helpful to conduct awareness surveys that confirm the level of understanding and to take part in continuous improvement through proposals.
A whistleblower is a person who reports or discloses inappropriate behavior by employees or officers of a company, or by civil servants or government institutions.
Disadvantageous treatment refers to any act that harms the working environment, including harassment, as well as changes to working conditions, such as unfair personnel evaluation, compensation, dismissal, and reassignment.
For example, in NDBS, including third parties, it is possible to report inappropriate acts by NDBS using the NTT Group-wide Corporate Ethics Help Line reception form shown below or via e-mail to [email protected] (NTT DATA Business Solutions internal Whistleblowing Hotline).
“NTT Group-wide Corporate Ethics Help Line” Reception Desk
Email: [email protected]
Reception Form: https://group.ntt/jp/corporate/contact/
In addition, complaints and information can be reported anonymously via the NDBS Complaints Form (nttdata-solutions.com/compliance/).
(Common – 3) Publicize and disclose the status of initiatives related to this Code of Conduct
Information publication and disclosure media include sustainability reports made through our website or through print media.
Environmental conservation activities includes the implementation status of guidelines (III-1) to (III-9), as well as independently set goals and the achievement plan and implementation status thereof.
(Common – 4) Collaboration for sustainability due diligence activities
(I-1) Prohibit forced labor
Forced labor refers to labor done by a person under threat of punishment and against their free will (involuntarily).
(I-2) Prohibit inhumane treatment
Mental abuse refers to harming the mental or emotional wellbeing of others by inflicting psychological violence on them, such as by harassing them, ignoring them, or using language that hurts their self-esteem.
Physical abuse refers to physical violence or work in harsh physical environments.
Coercion refers to forcing someone to do overtime work or commit acts they do not want to do, such as by threatening them.
Harassment refers to making someone uncomfortable by annoying or bullying them, and includes sexual harassment, power harassment, maternity harassment, etc. Specifically, it refers to sexually inappropriate behavior, sexual abuse, corporal punishment, mental or physical oppression, verbal abuse, and denial of equipment for basic physical comfort (furniture, etc.).
(I-3) Prohibit child labor and make considerations for young workers
Child labor can harm the intellectual, physical, social, or moral development of young people depending on the characteristics and execution of the labor. Specifically, it refers to activities or work that impair children’s educational opportunities and healthy growth by making it impossible for them to attend school, forcing them to drop out of school, or forcing them to both work and study.
According to the ILO Minimum Age Convention, 1973 (No. 138), the minimum age for employment or engagement in work must not be lower than the age at which compulsory education is completed, and in any case it may not be lower than 15 years (the minimum working age may be set to 14 years, in a transitional period in developing countries where economic and educational institutions are underdeveloped). The age at which young people can engage in work also differs depending on the type of work. With regard to hazardous work, all countries must set a minimum working age of 18 years. However, children may engage in such work from the age of 16 years under the following conditions.
Hazardous work refers to the following categories of work.
(I-4) Prohibit discrimination
(I-5) Proper wages and allowances
The minimum wage refers to the lowest wage specified in each country’s wage-related laws. This must be paid to workers at the appropriate timing without delay, based on the laws of each country.
Living wage refers to a wage level that meets the needs of workers and their families, enables them to have a social life, and gives them dignity, in accordance with international standards.
Improper wage reduction refers to wage reductions that violate labor related laws. However, this does not include non-payment of wages equivalent to scheduled hours not worked because a worker arrived late or was absent.
When paying compensation, suppliers shall also provide pay slips showing information that enables workers to confirm that their payment is correct.
(I-6) Regulate working hours
Appropriate management refers to the following.
Suppliers must grant working hours, holidays, and breaks to workers appropriately based on the legislation of each country. Suppliers also need to make consideration for international standards. For example, under ILO Hours of Work (Industry) Convention, 1919 (No. 1) and Hours of Work (Commerce and Offices) Convention, 1930 (No. 30), which are both international standards, weekly working hours are defined as not exceeding 48 hours per week including overtimes, except in the event of emergencies or crises. Also, in ILO Weekly Rest (Industry) Convention, 1921 (No. 14) and Weekly Rest (Commerce and Offices) Convention, 1957 (No. 106), it is stipulated that a minimum of 1 day (24 hours or more) of holidays be given for every 7 days of work (that is to say, workers must not work for more than 6 days consecutively). Furthermore, the ILO Reduction of Hours of Work Recommendation, 1962 (No. 116), which was issued as a social standard aimed at achieving the Forty-Hour Week Convention, 1935 (No. 47), has been adopted. Some industry standards limit working hours, including overtime, to 60 hours per week.
(I-7) Respect the right to freedom of association and collective bargaining
(I-8) Implement human rights due diligence in the supply chain
Suppliers with whom NDBS has direct transactions have a responsibility towards the suppliers that constitute their upstream supply chain to convey the requirements of and urge compliance with regard to human rights issues, as well as check compliance status, including whether or not there are any violations (In this Guidelines, “the suppliers that constitute their upstream supply chain” means your company’s supplier and subcontractors).
“OECD Due Diligence Guidance for Responsible Business Conduct” recommends that companies conduct risk-based due diligence to avoid and address negative impacts in their businesses and supply chains
(I-9) Promotion of “Technology that is based on high ethical standards.”
In using artificial intelligence (AI) and other new technologies, the symbiosis between humans and nature must be preserved. To this end, it is necessary to pursue research and development, utilization and social implementation of these new technologies with high ethical standards.
(I-10) Proper instruction to security forces
Supplier that commission security forces for the protection of the enterprise’s property or projects, shall instruct and control the security forces to prevent them from misusing their power, which result in;
(I-11) Lawful acquisition of land, forests and water
Suppliers have responsibility to take precautionary steps when acquiring, developing or using land, forests and waters, which secure the livelihood of people.
(II-1) Occupational Safety
Occupational safety risk refers to the potential risk of accidents or health problems occurring during work due to electricity or other energy, fire, vehicles and moving objects, floors that are easy to slip or trip on, and falling objects.
Appropriate design, technology, and management measures include the following examples.
Reasonable considerations for pregnant women and lactating mothers include the following examples.
When a worker must breastfeed a child they are raising within 1 year after birth, it is preferable to take measures such as providing adequate breaks for breastfeeding or milk pumping and a safe, clean place out of sight from coworkers and the general public.
(II-2) Apply safety measures for equipment and instruments
Appropriate safety measures refers to management to prevent accidents and health problems which occur during work, including the following measures.
(II-3) Promote hygiene in the workplace
Substances with harmful effects include those that are poisonous, radioactive, or cause chronic diseases (lead, asbestos, etc.). They can also be founded in the form of soot, steam, mist, dust, etc. Also, if there is significant noise or foul odors, it will be considered harmful to the human body.
Appropriate management refers to, for example, the following actions.
(II-4) Apply appropriate measures for occupational injuries and illnesses
Appropriate measures refers to, for example, systems and measures that make the following possible.
Also, the following actions are included as appropriate countermeasures.
(II-5) Prepare for and respond to emergencies
Report the details of occupational accidents and illnesses that occur in the course of the NDBS’s business operations and for which NDBS is legally, morally or ethically responsible.
Emergency response countermeasures refers to, for example, reporting of emergencies, notification to workers, clarification of evacuation methods, installation of evacuation facilities, easily understood and obstacle free exits, appropriate egress equipment, stockpiling of emergency medical supplies, installation of fire extinguishers, fire doors, and fire sprinklers, securing refers to of communication with the outside, and formulation of restoration plans.
It is also necessary for suppliers to spread information thoroughly in the workplace, which includes the following actions.
(II-6) Consider physical workload
Physically taxing work includes the following examples.
Proper management includes the following examples.
Appropriate management also includes developing a surrounding environment so that people can move correctly and efficiently, making consideration for how to reduce accidents and mistakes.
Ergonomics refers to the field of research for designing objects and environments so that humans can use them with the most natural movements and conditions possible, and making use of these in actual design. This also includes adjusting surrounding environments so that people can move correctly and efficiently, so as to reduce accidents and mistakes.
(II-7) Promote safety and hygiene in company facilities
To ensure safety and hygiene, suppliers must maintain the cleanliness and hygiene of company facilities and pay special attention to the following points.
(II-8) Conduct health maintenance programs for employees
Appropriate health management programs mean programs for prevention and early detection of illnesses among employees by conducting medical examinations at least at the level stipulated by the law. This includes adequate consideration for prevention of health problems due to overwork, as well as mental health care.
(II-9) Communicate about safety and hygiene
Education and training items include the following examples.
(III-1) Obtain environmental permits and report to the government
Permits stipulated by legislation include the following examples.
・ Permits concerning waste disposal
・ Permits concerning prevention of air pollution
Also, depending on the chemical substances used in their business, it may be necessary for suppliers to obtain permits for handling and management of poisonous substances, deleterious substances, specified chemical substances, and dangerous substances. Also, depending on their business content and locations it may be necessary for suppliers to obtain government permits for environmental impact assessment and facilities that handle hazardous materials.
(III-2) Manage chemical substances contained in products
Suppliers must comply with the legislation of the country that products are made for, as well as the Stockholm Convention on Persistent Organic Pollutants and the Basel Convention on the Control of Transboundary Movements of Hazardous Wastes and Their Disposal, with regard to substances contained in those products. Also, suppliers must take responsibility for parts embedded in final products, and companies in the upstream supply chain must provide information required by companies in the downstream supply chain (In this Guidelines, “companies in the upstream supply chain” means your company’s suppliers and subcontractors, and “companies in the downstream supply chain” means those with whom they provide products and services.).
(III-3) Manage chemical substances
・ Suppliers shall comply with the legislation of their respective countries to identify, label, and manage chemicals and other substances which pose a danger to human health and the environment, and manage said substances in order to ensure the safe handling, transportation, storage, use, recycling or reuse, and disposal thereof. Beyond domestic legislation, suppliers are prohibited to use mercury, mercury compounds or persistent organic pollutants in manufacturing processes.
(III-4) Minimize environmental pollution (wastewater, sludge, exhaust, noise, vibration, etc.)
Voluntary standards refers to having targets for reducing one’s environmental burden beyond the level stipulated by laws, etc. This of course includes preventing the occurrence of pollution, as well as activities that further reduce one’s environmental burden, such as improving methods for monitoring, controlling, and treating wastewater, sludge, exhaust, noise, and vibration, as well as reducing the amount of leakage and emissions thereof.
In wastewater management, the following examples are part of management of wastewater pollutant pathways.
In sludge management, appropriate treatment of sludge includes, for example, reducing the volume of sludge by concentrating, dehydrating, or incinerating it.
In exhaust management, toxic substances released into the atmosphere include volatile organic compounds, aerosol sprays, corrosive substances, fine particles, ozone-depleting substances, and by-products of combustion. Suppliers must analyze and monitor these substances before discharging them, and only discharge these substances after implementing necessary management or measures based on the results of analysis and monitoring. Countermeasures against the emission of toxic substances into the atmosphere include the following examples.
(III-5) Reduce energy consumption and greenhouse gas emissions
In 1997, the Kyoto Protocol was adopted at the 3rd Session of the Conference of the Parties to the United Nations Framework Convention on Climate Change (COP3). It set numerical goals for reducing emissions of 6 greenhouse gases: carbon dioxide (CO2), methane (CH4), nitrous oxide (N2O), hydrofluorocarbons (HFCs), perfluorinated compounds (PFCs), and sulfur hexafluoride (SF6). In 2015, the Paris Agreement was adopted at COP21 with the aim of solving the global issue of climate change. As a long-term goal shared by the whole world, it includes an agreement to keep the global average temperature rise from the level before the Industrial Revolution well below 2˚ C, and pursue efforts to keep the rise down to 1.5˚ C. It also includes an agreement for the latter half of the century to achieve an equilibrium between the amount of greenhouse gas emissions from anthropogenic sources and the amount of greenhouse gases removed by sinks (that is, to achieve carbon neutrality). At COP26 in 2021, it was reaffirmed that the long-term global goal is to keep the global average temperature rise from the level before the Industrial Revolution well below 2˚ C, and pursue efforts to keep the rise down to 1.5˚ C. In order to achieve these agreements and goals, it is crucial for all companies in the entire supply chain to be aware of them and work towards them, not only within each company, but also with suppliers and stakeholders upstream and downstream of each company (In this Guidelines, “suppliers upstream” means your company’s suppliers and subcontractors, and “suppliers downstream” means those with whom your company provide products and services).
The following are examples of frameworks in which each company voluntarily sets its own goals and conducts its own efforts to reduce greenhouse gas emissions.
(III-6) Reduce environmental burden by implementing product assessment
Product assessment includes the following examples.
(III-7) Effectively use resources and manage waste
Means of execution include the following examples.
It is crucial that suppliers set goals and act independently, in order to comply with legislation.
We also recommend that suppliers do not use or reuse disposable plastics, and do use compostable materials.
(III-8) Conserve biodiversity
(III-9) Implement environmental investigations in the supply chain
If there are concerns about violations of the law or serious environmental destruction with regard to suppliers that supply raw materials and parts and the suppliers or provide services, then suppliers shall conduct investigations and take appropriate corrective measures and preventive measures.
(IV-1) Prevent corruption and illegal political contributions, prohibit improperly providing or receiving benefits
Bribery refers to providing money, entertainment, gifts, or other benefits and conveniences to civil servants and equivalent people (hereinafter referred to as “civil servants, etc.”) in pursuit of some kind of business favors, such as receiving permits, acquiring or maintaining transactions, obtaining non-public information, etc.
Bribery also includes providing entertainment and gifts that go beyond social courtesies to civil servants, etc., even when not pursuing business favors.
Illegal political donations include, for example, making political donations in pursuit of some kind [ii]of business favors, such as receiving permits, acquiring or maintaining transactions, obtaining non-public information, etc. It also refers to making political donations that do not follow formal procedures.
(IV-2) Prohibit abuse of dominant bargaining position
Abuse of dominant bargaining position refers to taking advantage of a dominant position as a buyer or outsourcer, for example, by the following actions.
Suppliers are required to fairly and faithfully conduct procurement transactions based on contracts, in order to prevent abuse of dominant bargaining position. In countries with legislation relating to abuse of dominant bargaining position, suppliers are required to comply with relevant laws.
(IV-3) Execute business fairly
Fair advertising refers to advertising which does not have an improper purpose or provide false information. Furthermore, it refers to not making expressions that mislead consumers or customers, and making considerations to not include content that slanders or infringes upon the rights of other companies or individuals.
(IV-4) Respect intellectual property
Intellectual property refers to intellectual property rights, as well as know-how of trade secrets and technologies, etc.
Intellectual property rights are rights protected by law, including patent rights, utility model right, design rights, trademark rights, copyrights, and so on.
(IV-5) Appropriately manage imports and exports
Technologies and goods regulated by law include parts, products, technologies, facilities, and software for which export is regulated by legislation based on international agreements (such as the Wassenaar Arrangement). Exports may require specific procedures, such as acquiring permission from governmental regulatory authorities.
(IV-6) Prevent improper acts
Activities to prevent improper acts refers to educating and enlightening employees, as well as creating a rich communication environment in the workplace.
(IV-7) Responsibly procure minerals and carry out due diligence
It is said that some minerals produced in conflict areas are potentially a source of funds for militants who commit inhumane acts and thereby promote conflicts, or cause human rights violations.
In order to fulfill corporate social responsibilities in procurement activities, NDBS will work with suppliers to ensure the transparency of the supply chain. Furthermore, with respect for the spirit of the “Dodd-Frank Wall Street Reform and Consumer Protection Act” signed into law in the USA in July 2010, we will promote initiatives to eliminate the use of conflict minerals, which are a source of funds for militants.
Even in areas where there are conflicts, some minerals are not a source of funds for militants, so we will work to prevent militants from using those minerals.
The internationally recognized “OECD Due Diligence Guidance for Responsible Supply Chains” gives the following five steps for due diligence regarding responsible mineral procurement.
Step 1: Establish strong company management systems
Step 2: Identify and assess risks in the supply chain
Step 3: Design and implement a strategy to respond to identified risks
Step 4: Carry out independent third-party audits of smelter/refiner’s due diligence practices
Step 5: Report annually on supply chain due diligence
(V-I) Ensure product safety
Examples of Japanese laws on product safety include the Electrical Appliance and Material Safety Law, the Consumer Products Safety Law, and the Household Goods Labeling Law. Japanese safety standards are defined in detailed regulations, JIS, etc. Foreign safety standards include UL (USA), BSI (UK), and CSA (Canada).
Effective ways of ensuring product safety include management such as traceability (history of materials, parts, processes, etc.) and prompt responses to solving problems.
(V-2) Provide accurate product and service information
Accurate information that is not misleading includes the following examples.
(VI-1) Provide products and services that take into consideration security and privacy
Suppliers must provide data confidentiality, authenticity, integrity, and availability in order for products or services to have consideration for security and privacy. When developing a product or service, it is crucial for suppliers to develop and implement policies and procedures that do not allow for backdoors, malware, or malicious code to be included in the product or service. It is effective to conduct regular security scans, tests, and fixes on products, services, and the infrastructure they rely on, as well as to prepare processes to ensure that products and services are authentic and verifiable.
It is critical that product or service providers offer guidelines for secure configuration, operation and use. Furthermore, it is important for providers to offer contact information, security advice, vulnerability management, and security patches according to risk during the support period. As a prerequisite for this, it is effective to appropriately implement asset management, vulnerability management, and modification management policies, which can reduce risk to the service environment.
(VI-2) Prevent the leaking of confidential information
Confidential information usually is any information disclosed with a document, etc. (including electromagnetic or optically recorded data information) that is agreed to be confidential, or disclosed verbally after having been notified of its confidentiality.
Appropriate management refers to building and operating general management mechanisms for confidential information, preparing norms and policies that workers should comply with, as well as planning, implementation (access management with ID of an appropriate level, etc.), auditing, and revision according to those norms and policies.
Appropriate protections refers to preventing unauthorized or improper acquisition, utilization, disclosure, or leaking of sensitive information throughout the entire data life cycle. It is necessary to implement data protection by such means as appropriate encryption. It is also critical to properly manage entry and exit to facilities, so as to prevent unauthorized physical access.
(VI-3) Protect personal information
Personal information is any information about existing individuals, which can be used to identify a specific person, such as their name, birth date, and other descriptive information. It also includes information that can be easily checked against other information to identify a specific person.
Appropriate management refers to building and operating general management mechanisms for personal information. This includes preparing norms and policies that workers should comply with, as well as planning, implementation, auditing, and revision according to those norms and policies.
Appropriate protection refers to not improperly or unfairly obtaining, utilizing, disclosing, or leaking personal information.
(VI-4) Take countermeasures against cyber attacks on one’s own company
Cyber attacks refer to acts that cause damage such as leaking trade secrets or personal information, customer information, business partner information, and confidential information, or the encryption of important files, by such means as malware infections through targeted emails or misleading users to malicious websites.
It is necessary to prevent trouble such as information being leaked or manipulated or information systems going down due to cyber attacks. The attacker may expand the scope of their attack to other targets using customer information or business partner information they have obtained, so the damage is not limited to one’s own company.
Devices targeted for cyber attacks have are extending beyond conventional PCs and servers to include devices in industrial systems and the IoT (Internet of Things), so it is possible to take countermeasures with these devices as well. It is also crucial to formulate plans for quick recovery in the event of a cyber attack. Countermeasures include backing up important data and securing redundant servers and data centers.
For suppliers who have contracts with cloud services, it is also important to confirm that such plans have been formulated and are feasible from the contract conditions.
(VI-5) Respond to security incidents
As a precautionary countermeasure, it is critical to have a local restoration strategy, concerning how to protect, mitigate, and restore individual elements of a production base against possible damage. It is also crucial to secure alternative means of production, assuming that recovery from damage caused by a disaster may take a long time. It is effective to prepare a manual for rapid recovery of business according to contents described in a business continuity plan, and continuously educate and train employees so that they can respond to actual disasters when the business actually has stopped.
[Inquiries]
NTT DATA Business Solutions AG
Corporate Compliance Department
