Data Privacy
Why It Matters | Our Approach | Progress | What's Next | Related Topics
Last updated: July 1, 2026
Why It Matters
To Lilly
The trust and confidence of our customers, consumers, and employees in how we collect, use, and share their personal information shapes how we are able to operate. We work to maintain and strengthen the standards, systems, processes, and controls that help us effectively manage data privacy risks.
To the World
As technological advancements and widespread data availability reshape how personal information is collected and used, people need to be able to trust that the organizations they interact with are handling their data responsibly. Strong data privacy practices protect individuals and support broader confidence in healthcare and the systems people depend on.
Approach
Our longstanding global privacy program reflects our approach to transparency in how we collect, manage, use and disclose personal information. We are intentional about protecting personal information and strive to use the minimum amount necessary to do our work. We share personal information only with those who are authorized and have a legitimate business need to see it, and we contractually require our suppliers and third parties to handle personal information in accordance with our privacy expectations as well as applicable laws and regulations. Our privacy expectations are aligned to foundational privacy principles, like providing appropriate notice and choice and processing personal information for limited purposes.
We expect our employees, contractors and anyone working on our behalf to work responsibly and protect the personal information that is entrusted to us. These expectations are stated in our global policies maintained through Lilly's privacy program, and they are reinforced in enterprise-wide training on the responsible use of personal information.
Governance
The Digital Legal Office within the Legal department oversees the privacy program for our operations around the world and is led by our chief privacy officer, working with a team of global and local privacy experts. As data volumes grow and as data privacy laws proliferate in the U.S. and worldwide, privacy has become a board-level priority. The privacy team actively engages with key external constituents to stay abreast of emerging privacy laws, related risks, and the potential consequences of noncompliance. This ongoing external engagement supplements the team's standard risk assessment process and ensures leadership remains informed of significant developments. The privacy team also shares developing privacy requirements and identifies key privacy risks to our broader ethics and compliance organization, as well as to other key internal stakeholders, including our internal audit team.
Progress
In 2025, we continued to strengthen our privacy program in response to a rapidly evolving regulatory landscape. As new comprehensive data privacy laws took effect across additional U.S. states and international jurisdictions, our privacy team worked to establish a foundational Privacy Framework with privacy controls that are rooted in these legal requirements and Lilly's privacy expectations. These privacy controls now serve as the basis for privacy program maturity that will aid the Digital Legal Office to assess requirements, update internal procedures, and ensure ongoing compliance. We also maintained our enterprise-wide training program and continued to integrate privacy considerations into broader ethics, compliance, and AI governance efforts.
What's Next
As data privacy regulation continues to expand globally, we will keep evolving our program to meet new requirements and address emerging risks particularly at the intersection of privacy, AI, and digital health. We remain focused on ensuring that our practices reflect both the letter of the law and the trust that patients, customers, and employees place in us.