Trust Center
We believe transparency builds trust. At Arcadis, we protect information, handle personal data responsibly and use AI in ways that are governed, secure and aligned with our values. We provide clients, partners and communities confidence in how we deliver our digital solutions. This Trust Center brings together key information about how we manage AI, privacy and information security across our business.
1. Information Security
Arcadis is committed to the highest standards of information security across our operations.
Certifications Maintained:
- ISO/IEC 27001 (Information Security Management System)
- CMMC (Cybersecurity Maturity Model Certification)
- Cyber Essentials Plus
- IEC 62443 (Industrial Cybersecurity for Operational Technology)
These certifications demonstrate our robust controls, risk management and continuous improvement in cybersecurity.
How We Protect Information
Arcadis protects information through strong governance, policies, controls and employee awareness. Our information security management system is aligned with international standard ISO/IEC 27001 and is designed to protect the confidentiality, integrity and availability of information across our business.
Our Approach
We apply a risk-based approach to information security that includes:
- Clear governance and accountability
- Risk management and continuous improvement
- Information classification and protection of sensitive information
- Identity and access management
- Secure management of technology, networks and systems
- Network protection and system integrity
- Disaster recovery and business continuity measures
- Vulnerability Management and Malware Protection
- Security Logging, Monitoring and Incident Response
- Physical and environmental security across our offices and facilities
- Training and awareness
- Supplier and third-party security management
Together, these measures help safeguard information from misuse, loss, unauthorized access, alteration and disclosure.
Our information security management system is maintained and continually improved to respond to changes in the information risk landscape, evolving business requirements, emerging threats and applicable legal, regulatory and contractual obligations. Supporting policies, standards and controls are reviewed and updated periodically to help ensure they remain effective and aligned with business needs.
In addition to independent external audits and certifications, Arcadis operates an internal assurance programme through which information security controls are periodically evaluated for effective design, implementation and operation.
2. Responsible AI
Our approach to AI
We see artificial intelligence as a tool to enhance our services and products, support our people and continuously improve the way we work. Our approach is human-centric: AI supports, and does not replace, the professional judgement, accountability and expertise of our people.
We assess AI tools, AI-enabled solutions and their capabilities in line with applicable laws, client commitments and Arcadis' internal governance standards. That includes considering the role Arcadis plays in each case, whether we are using AI in our own work or building it into the solutions we deliver.
How we govern AI
Our cross-functional AI governance framework provides oversight across the AI lifecycle: selection, approval, deployment, ongoing monitoring, change management, periodic review and retirement. Executive-level governance sets our risk appetite and the AI uses we will not pursue. Governance is proportionate to risk. When we evaluate AI tools, use cases and AI-enabled solutions, we consider:
- the intended use and who may be affected
- the nature of the data involved
- access controls
- system configuration
- vendor and technology risks
- the need for appropriate human review of AI-assisted outputs.
Transparency and human oversight
Where AI is used in a significant or customer-relevant way, we aim to be transparent about its role and about the measures that support its responsible use. Our policy requires AI-assisted outputs to be reviewed by an appropriately qualified person before they are relied on or shared.
We provide guidance and training so employees can use approved AI tools responsibly, review AI-assisted outputs, protect confidential and personal data, and raise potential risks or concerns.
Safeguards for AI use
Our use of AI is supported by enterprise security, access controls and information governance measures. Customer information is handled in line with applicable confidentiality, privacy and legal requirements.
3. Privacy
Protecting personal data is fundamental to how Arcadis earns and maintains trust.
Arcadis maintains a global privacy programme for the responsible handling of personal data across its operations. While our approach is based on internationally recognised privacy principles and the requirements of the EU General Data Protection Regulation (GDPR), it is designed to accommodate additional legal and regulatory requirements that apply in the jurisdictions where we operate.
We embed privacy into the way we work through governance, training, oversight and practical safeguards designed to promote consistent standards across our global organisation and the responsible handling of personal data in our day-to-day operations. Our global privacy framework is supported by internal policies, privacy-by-design practices and clear accountability. Its implementation is overseen by a global network of privacy professionals and local privacy officers who help oversee compliance and support the effective implementation of privacy requirements across Arcadis.
Privacy Risk Management and Accountability
We assess privacy risks through data protection impact assessments and other risk assessment processes, maintain records of processing and other accountability documentation, and integrate privacy considerations into our decision-making and governance activities.
Transparency and Individual Rights
We handle personal data responsibly and transparently so that clients, partners and other individuals can understand how their information is used and protected. We seek to collect, use and retain only the personal data necessary for defined business purposes, and to process personal data in accordance with applicable legal requirements, including principles of lawful processing, purpose limitation and data minimisation. Our privacy notices provide further information on how personal data is collected, used, shared and protected, and how individuals can contact us or exercise their rights.
International Transfers
As an international business, Arcadis may transfer or provide access to personal data across borders, including within the Arcadis group. To support these transfers, Arcadis has adopted Binding Corporate Rules (BCRs) for both controller and processor activities, which have been approved by the EU data protection authorities.
Where required, we also rely on other appropriate safeguards such as contractual protections and supplementary measures. These safeguards are intended to ensure a consistent level of protection across Arcadis group companies and our partners.
Further information on the safeguards we apply to international transfers is available via the links below:
Privacy Incidents
We maintain global processes to identify, assess, manage and, where required, notify relevant parties of privacy incidents. These measures support a consistent, accountable and risk-based approach to data protection across our global operations.