2024 universal registration document

3. Risk factors and management

Business risks/Data  Moderate
Risk identification Risk management

The data collected and processed by L’Oréal or its partners, the volume of which is increasing with the growth in digital activities, particularly personalised services for consumers, could be altered, lost, illegitimately copied or transferred or even fraudulently used. Furthermore, personal data protection regulations are being reinforced throughout the world. In particular, the European General Data Protection Regulation (EU) 2016/679 of 27 April 2016, which came into force on 25 May 2018, known as the GDPR, provides for major sanctions in Europe, as does the CCPA in California, the LGPD in Brazil or the PIPL in China and the POPI Act in South Africa. The increasing adoption of various laws aimed at limiting and controlling the transfer of data is also a growing risk factor to which L’Oréal is exposed.

Any breach of data integrity or confidentiality, particularly personal data processed by L’Oréal or its partners, for exogenous or endogenous reasons (including intrusions, malicious acts, etc.) could impact the privacy or safety of its users, have a significant impact on its reputation and consumer confidence and thus on the Group’s business activities and financial position. 

The Group constantly and progressively rolls out policies, training and data management tools as well as the associated organisational and technical measures. The Global IT Department has introduced strict rules about data security (back-up, protection and restrictions on access to confidential data). See also the “Information systems and cybersecurity” risk. The Group is extremely attentive about the use of data in connection with artificial intelligence technologies.

The Group’s principles governing the processing of personal data have been rolled out all over the world to raise the awareness of all employees about respect for ethical principles, and legal and regulatory requirements in the matter.

The organisation set up is based on a Global Data Privacy Office at Group level, comprising a legal unit and a programme unit. A Group Data Protection Officer was appointed in 2018 and a network of 51 Country DPOs has been created for all countries in the Europe Zone and gradually in other regions of the world.

The governance is based on a Global Strategic Committee, a Steering Committee by region, as well as a network of Heads of Data Privacy within the Transversal Functions and Zones, responsible for the protection of personal data. They provide support to all operational stakeholders involved.

This governance structure aims in particular to monitor the Group’s compliance with different laws, by ensuring the mobilisation of all stakeholders and by adapting customer, supplier and business line processes to the Group’s rules and to applicable laws.

L’Oréal’s commitments in terms of personal data and the risk management systems are detailed in section 4.8.

Business risks/Beauty market and innovation  Moderate
Risk identification Risk management

L’Oréal is under constant pressure from many competitors and players in the beauty industry in all countries due to:

  • its size and the positioning of its brands in various markets in which major international groups operate;
  • local brands and new players coming from the digital economy; and
  • fast-changing technological developments, including in emerging fields of research by new market participants, both in terms of products and raw materials.

If the Group fails to anticipate or respond to changes in consumer expectations, especially in the areas of natural beauty, health, personalised services, smart objects and environmental commitments, with innovative and adapted product offerings, its sales and growth could be affected.

The Group continually adapts its innovation model and is constantly increasing its investments in research and digital services.

L’Oréal’s Research & Innovation (R&I) team innovates to respond to the infinite diversity of beauty aspirations all over the world. The R&I team enters into research and development partnerships for new products, technologies and raw materials, particularly under the Group's Open Innovation programme, and BOLD (Business Opportunities for L'Oréal Development) invests in innovation companies. The Consumer & Market Insights Department, within the Innovation Department, constantly monitors changes in consumer expectations by product category and major regions of the world, and a tool has been introduced to measure consumer satisfaction with the Group's products. The Group also tracks changes in consumer aspirations and behaviour by analysing sales and monitoring social media.

These research programmes all form part of a long-term vision. They equip L’Oréal to rise to the challenges of innovation (see section 1.3.4).

The Digital and Marketing Department is responsible for accelerating the Group’s digital transformation by helping the brands create more conducive spaces for expression and supporting teams in forging more interactive, close-knit and bespoke relationships with consumers.

Consumer expectations with regard to sustainability are also at the heart of the L’Oréal for the Future programme (see chapter 4). These are taken into account in developing the Group’s brand and product portfolio.

The Group’s acquisition strategy always takes into account changes in the competitive environment.