Internal privacy policy 

POLICY PURPOSE

This policy sets clear rules for how Arm people handle personal data in their daily work, translating legal and regulatory requirements into practical guidance. Its purpose is to ensure compliance with privacy laws, reduce the risk of data misuse or breaches, clarify roles and responsibilities, and promote consistent, accountable decision-making across the organization. By serving as a reference for training, audits, and enforcement, it helps embed a culture of privacy awareness and shared responsibility among employees.

Arm has implemented this Internal Privacy Policy (hereafter, “Policy”) for the purpose of governing the treatment of our employees', contractors’, other personnel, customers’, suppliers’ and any other, Personal Data that Arm may handle as part of its business operations. The loss of Personal Data can result in harm to individuals, including embarrassment, inconvenience, and fraudulent use of the information. Protecting the confidentiality and integrity of Personal Data is a critical responsibility that must be taken seriously at all times."Personal Data" means information that identifies or relates to an identifiable individual, and includes, but is not limited to names, contact details, employee ID numbers, government-issued identifiers, and financial account numbers.

The purpose of the policy is to:

  • Define Personal Data and Sensitive Personal Data;
  • Establish general principles for protecting Personal Data; and
  • Assign accountability for protection of Personal Data.

APPLICABILITY

This policy applies to all Arm employees and Directors as well as agents and contractors. Violation of this policy may result in corrective or disciplinary action, including the potential for termination of employment.

Breach of applicable laws or regulations can amount to a criminal offence in many jurisdictions where Arm operates. Violation could therefore result in criminal proceedings and severe penalties for Arm and the individuals involved.


Policy Statement

Arm’s Board of Directors (“Board”) has made a commitment to carry out its business fairly, honestly, and openly.

Individuals must:

  • Manage the privacy risk related to the processing carried out by the function; everyone should be aware of the need to protect Personal Data.
  • Ensure the security of the Personal Data they process.
  • Adhere to this Internal Privacy Policy and privacy procedures.
  • Report privacy incidents immediately

You must comply with all of Arm’s internal controls, especially those designed to ensure accurate and complete books and records.

There are no exceptions to this Policy, even if our competitors engage in improper behavior or if corruption is an accepted practice in a country where we operate. You are required to adhere to both the spirit and the letter of this Policy with respect to our business anywhere in the world.

We must always act with integrity and speak up when we have questions or need to report concerns. There are many resources at Arm we can contact, including:


Expected Behavior

Everyone is expected to be able to identify Personal Data and uphold Arm’s Data Protection Principles, set out in this policy.

  • Inform individuals about how Arm will use, process, disclose, protect, and retain their Personal Data by presenting a privacy policy or privacy notice to the individual at the time the individual provides the Personal Data;
  • Collect only Personal Data directly relevant and necessary to accomplish the legitimate specified business purposes and in compliance with applicable Arm policies and notices;
  • Use Personal Data solely for the purpose(s) for which it was collected, and for legitimate business purposes only;
  • Do not share Personal Data unless authorized to do so. Only share Personal Data with another Arm employee, agent, or representative if the recipient has a job-related need to know the information. Personal Data may only be shared with a service provider if it has a need to know the information for the purpose of providing the contracted services. If you do need to share Personal Data, please refer to Information Sharing Guideline (a copy of which is available from privacy@arm.com) for the recommended options;
  • nsure that Personal Data is accurate, up-to-date and relevant to the purpose(s) for which it is collected;
  • Arm has implemented an information security program that sets out technical, administrative, and physical safeguards for the protection of Personal Data. Everyone at Arm must follow the security procedures set out in the program at all times. You must exercise particular care in protecting sensitive Personal Data (e.g. Social Security numbers and other government-issued identifiers, financial account information, passwords, diversity information, etc.) from loss, unauthorized access, and unauthorized disclosure;
  • Comply with Arm’s AI Policy and ensure you only input Personal Data into AI Tools where permitted under that policy and in accordance with instructions from Arm’s AI Office;
  • Ensure proper management and supervision of the handling of Personal Data by third party service providers with whom we share Personal Data;
  • Avoid accessing, collecting or storing Personal Data that is not necessary for your current job responsibilities. You may not access Personal Data for any reason unrelated to your job duties;
  • Secretly recording conversations is not permitted;
  • Retain and dispose of Personal Data securely and in accordance with Arm’s Record Retention Policy and Schedules;
  • • Honor individual rights with respect to their Personal Data. These rights may vary depending on the applicable jurisdiction, but may include for example: the right to know what Personal Data Arm maintains about the individual and/or with whom the Company has shared the Personal Data, the right to access, correct or delete the Personal Data, and the right to opt-out of sales, targeted advertising, marketing or other activities. If you receive a request or complaint regarding the handling of Personal Data, please contact privacy@arm.com; and
  • Complete Arm’s required Privacy and Data Protection training. If you are unsure about whether collecting Personal Data, or whether a specific use or disclosure, is appropriate, or on how to apply any of these principles, you should raise with your manager, via email to privacy@arm.com, or the People Team

Reporting Security Incidents

If you know or suspect that a security incident has occurred, do not attempt to investigate the matter yourself. Immediately contact security@arm.com. This includes any of the following:

  • any suspicious activity related to a computer, network, or software application;
  • any potential or actual loss, misuse, or improper access or modification of Personal Data;
  • compromise of the security of any system or device containing Personal Data; or
  • access, use or disclosure of Personal Data in violation of any applicable policy.

This includes accidental disclosure to unauthorized personnel within Arm or unauthorized sharing with any third party.


Your legal rights

If you are located in a European Union Member State and certain other countries, you have the following additional rights:


Access and / or have your information provided to you

You can request a copy of the Personal Data we are processing about you.


Change or correct

You can ask us to change, fix or update information about you (for example, if it is incomplete or inaccurate).


Deletion

You can ask us to delete Personal Data about you.


Restrict or limit use

You have the right to restrict our processing (i.e., stop any active processing) of your Personal Data (for example, if the information about you is inaccurate).


Portability

In certain circumstances, you have the right to obtain Personal Data we hold about you in a structured, electronic format, and to transmit such data to another data controller.


Object

You have the right to object to Arm using your Personal Data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing). See below for information about how to unsubscribe to direct marketing.


Opt-out

You can withdraw your consent, including for marketing messages that you receive from us.

Please note that these rights may be limited, for example if fulfilling your request would reveal Personal Data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep. If you have unresolved concerns, you have the right to complain to a data protection authority as described below.

If you wish to make a Data Subject Access Request, please contact privacy@arm.com

The Global Privacy Office is responsible for resolving questions about the appropriate interpretation of this Policy in light of legal and regulatory requirements, with input from Arm Legal.


VI. Reporting concerns

Procedures to report concerns on this topic. Including the following default language:

  • You may choose to report your concerns to your manager, via email to privacy@arm.com, or the People Team. Managers have a responsibility to ensure that all reports are escalated to the privacy team and responded to appropriately.
  • Alternatively, you may choose to report your concerns to the Office of Ethics and Compliance via email: legalethics@arm.com.

If you believe that there has or might have been a breach of this Policy, you may immediately report your concerns through the Arm Integrity Helpline. Reports are kept confidential and can be made anonymously, where allowed by local law.

There are two options:

  1. Make a written report to the Office of Ethics and Compliance via email: legalethics@arm.com
  2. Make a report verbally:

    • United Kingdom: 0-808-189-1053
    • United States: 1-800-461-9330
    • France: 0805.080339
  3. Other countries, please write to the Office of Ethics and Compliance via email: legalethics@arm.com

Arm will not tolerate retaliation against anyone, who in good faith, reports a concern or cooperates with a compliance investigation, even when allegations are found to be unsubstantiated.


VII. Defined Terms

This Policy includes the following defined terms:

  • Relevant Persons includes directors, officers, and employees (staff, contract, and temporary) of Arm and its subsidiaries, and extends to all our majority-owned businesses and dealings and transactions in all countries in which Arm operates.
  • Intermediaries includes agents, consultants, representatives, lobbyists, suppliers/vendors, resellers, distributors, customs or other brokers, contractors, advisors, and other business partners.

Further information

Data subject access requests

Only employees who are residents of California or work for an Arm company in the EEA or the UK are entitled to request the personal data held about them. If you are a resident of California, or you work for an Arm company in the EEA or the UK please please contact privacy@arm.com if you wish to make a Data Subject Access Request.

Global Privacy Team

The Global Privacy Team is responsible for resolving questions about the appropriate interpretation of this Policy in light of legal and regulatory requirements, with input from Arm Legal. If you have any privacy or data protection questions, please email the Global Privacy Team at privacy@arm.com.

Compliance and Monitoring

The Global Privacy Team, in conjunction with applicable departments such as Internal Audit, is responsible for monitoring compliance with this Policy.

This Policy shall be reviewed annually.