Last updated: 18 July, 2026
Moody's Analytics Sweden AB, a Moody’s Corporation company of Box 160, 101 23 Stockholm, Sweden (“Moody’s”, “we”, “us”, or “our”) respects your privacy. This privacy notice explains in detail how we process Personal Data in The Nordic PEP List (the "Product").
“Personal Data” means information which identifies, or can be used to identify, a living individual.
The Product is a database containing information about politically exposed persons, their family members, and close associates located in the Nordic region. The Product is designed to assist financial institutions, corporations, government agencies and other entities (“Authorized Subscribers”) in meeting their legal, regulatory, and compliance obligations, including know-your-customer ("KYC"), anti-corruption and bribery ("ABC"), and other financial crime compliance requirements (“Compliance Checks”).
Authorized Subscribers are responsible for ensuring that their use of the Personal Data in the Product complies with applicable laws and regulations. Authorized Subscribers are responsible for how they use the results of a check performed using the Personal Data, for example, whether to do business with a customer. Moody’s does not make any decisions on behalf of Authorized Subscribers about individuals.
The Product contains the following types of Personal Data about politically exposed individuals and their family and close associates located in the Nordic region:
The Personal Data is limited to those necessary for the purposes. For example, without name and contact details, Authorized Subscribers would be unable to look up individuals; without date of year of birth, it would be easy to mix up individuals with the same or similar names leading to cases of mistaken identity.
Due to the nature of the sources of Personal Data, Moody’s seldom has contact details for individuals whose Personal Data may be in the Product in order to contact them directly. Moody’s does not have a direct relationship or nexus with the individuals. Authorized Subscribers, who do hold reliable contact details, are required to notify individuals that they will process their Personal Data in the Product for Compliance Checks, as required by applicable law. Note that, given the nature of Compliance Checks, there may be circumstances where Authorized Subscribers are exempt under applicable law from providing notice to affected individuals, on the basis that the provision of the information would make impossible or seriously impair the achievement of the objectives of the processing.
Moody’s sources the Personal Data from public records across Sweden, Norway, Denmark, and Finland. These include national population registers (such as Sweden’s SPAR, Norway’s National Population Register, and Denmark’s CPR register), which provide and verify information relating to individuals, including identity details, addresses, dates of birth, and, in Sweden, family relationships. The Product also draws on official company and business registers, including the Swedish Companies Registration Office, Norway’s Brønnøysund Registry, Denmark’s CVR register, and Finland’s Virre register, to identify corporate positions, state-owned company affiliations, beneficial ownership information, and other business relationships. In addition, official property registers in Norway, Denmark, and Finland are used to verify identity information, while Finland’s association register and the Danish Financial Supervisory Authority’s PEP list provide supplementary information relating to political and organizational affiliations.
To identify relatives and close associates, the Product combines information obtained from official registers with publicly available sources. In Sweden, family relationship information is primarily sourced from the Swedish Tax Agency’s population register. In the other Nordic countries, where access to population registry information is more limited, family relationships are identified through publicly available information, including media reports, published biographies, publicly-available CVs, publicly-available social media websites and posts, and recognized reference publications. Once a relationship has been identified, information from official population, company, and property registers is used, where possible, to verify the relationship and obtain additional identifying details.
Personal Data is collected by both manual and automated means.
Moody’s processes the Personal Data for the purposes of providing the Product to its Authorized Subscribers, including analyzing and modelling the Personal Data to improve its accuracy and to develop and improve services.
Authorized Subscribers use the Product to assist them with their Compliance Checks, as described above in the section “Purposes of Processing”. Moody’s does not make decisions on behalf of Authorized Subscribers and Authorized Subscribers are responsible for how they use Personal Data in the Product and their Compliance Checks, for example, whether Personal Data in the Product is a probable match to an Authorized Subscriber’s search enquiry and/or whether to do business with a customer. Authorized Subscribers must use further information in their possession to conduct Compliance Checks, including information provided to them directly by applicants as well as other third-party sources, and are contractually required to not solely rely on data in the Product.
We may disclose Personal Data for the following purposes:
We implement appropriate data accuracy measures to manage the accuracy and integrity of Personal Data in the Product, including using official government and regulatory data sources, and providing the ability to affected individuals to access and correct (if required) their Personal Data.
We implement appropriate data security safeguards to protect the Personal Data, including physical security measures, system hardening, patch management, vulnerability management, access controls, and implementing anti-virus and anti-malware protections, data incident policies and procedures.
The Personal Data is stored for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure, and the applicable legal, regulatory, tax, accounting or other requirements. We have in place appropriate Personal Data retention policies and procedures.
Individuals whose Personal Data is in the Product may have rights under applicable data privacy laws. If you have any complaint or concern regarding how Moody’s processes Personal Data, or would like to request to review, correct, update, suppress, delete or otherwise limit our use of Personal Data, contact us using the information provided in the “Contacts & Queries” section below.
Individuals may also have the right to complain to the local data protection authority with concerns about how we process Personal Data. However, we hope we can solve any queries or concerns individuals may have, so please contact us directly in the first instance.
The relevant legal basis for the collection and processing of Personal Data is the legitimate interests basis:
Moody’s has put in place measures to protect Personal Data which is transferred from the European Union. To transfer Personal Data outside of the European Union, Moody’s has put in place EU standard contractual clauses, to provide an equivalent level of data protection. To request a copy of these clauses, please contact us as specified in the “Contact & Queries” section below.
If you have any questions, complaints or comments regarding Moody’s privacy practices you can do this via email at privacy@moodys.com or write to us at:
Legal Department
Moody’s Corporation
7 World Trade Center at 250 Greenwich Street
New York, NY 10007
Phone: +1-212-553-1653 or 1-866-995-9659
E-mail: privacy@moodys.com
If you choose to contact Moody’s via e-mail about this privacy notice, please mark the subject heading of your e-mail “Privacy Inquiry.”
The most current version of this Privacy Notice will always be available here. You can check the “effective date” posted at the top to see when this Privacy Notice was last updated.
How can individuals whose Personal Data is in the Product access a copy?
Please contact privacy@moodys.com or use the contact details listed in the “Contacts & Queries” section above for requests to access Personal Data, and for any other requests to correct, update, or object to processing of Personal Data, to the extent that such rights apply under applicable law. Moody’s does not charge for such requests, but may request further information as necessary to identify individuals and locate their Personal Data. Moody’s reserves the right to deny unreasonable or unwarranted requests, as permitted under applicable law.
Is Personal Data in the Product available to the general public?
No, Moody’s does not distribute the Product data to the general public. Access is only permitted to Authorized Subscribers, who are subject to contractual obligations, including of security, confidentiality and appropriate use.
What steps does Moody’s take regarding the accuracy of Personal Data in the Product?
Moody’s implements appropriate data accuracy measures to manage the accuracy and integrity of Personal Data in the Product, including using official government and regulatory data sources, and providing the ability to affected individuals to access and correct (if required) their Personal Data. Further, note that all information in the Product is provided to Authorized Subscribers on an informational basis only. Authorized Subscribers are contractually required to make their own further enquiries and cannot rely solely upon information in the Product when making any decisions.
Does Moody’s provide direct notice to individuals whose Personal Data is in the Product?
No, as explained above in the section “Sources of Personal Data”, the Personal Data is collected from public sources (such as government and regulatory lists) and those sources generally do not provide contact details such as email. Further, Moody’s does not have a direct relationship or nexus with the individuals whose Personal Data is in the Product. Authorized Subscribers, who do hold reliable contact details and have a direct nexus with the individuals they look up in the Product, are required to notify affected individuals of processing their Personal Data, as required under applicable law. Given the nature of Compliance Checks, there may be circumstances where Authorized Subscribers are exempt under applicable law from providing notice to affected individuals, on the basis that the provision of the information would make impossible or seriously impair the achievement of the objectives of the processing.
Does Moody’s obtain the prior explicit consent from affected individuals whose Personal Data is in the Product?
No, as explained above in the section “Sources of Personal Data”, the Personal Data is collected from public sources (such as government and regulatory lists) and those sources generally do not provide contact details such as email, in order for Moody’s to contact affected individuals directly. Further, Moody’s does not rely on consent as the legal basis to process Personal Data in the Product. As explained above in the section “Supplementary Information for the European Union”, Moody’s relies on the legitimate interests basis, and for special category Personal Data, public interest exemptions of compliance with law and obligation.
Does Moody’s have a privacy complaints process?
Yes, as explained above, for any privacy complaints or concerns, please email us at privacy@moodys.com or use the address or telephone number listed in the “Contacts & Queries” section above.
