We adopt a risk-based approach to privacy and have a dedicated privacy and security team that offers advice, support and cyber security solutions. We also seek innovative ways to further digitise our privacy and security operations. Our Group privacy framework clearly defines internal accountability, roles and responsibilities, as well as our risk management processes, privacy requirements, privacy mitigation and assurance methodology. To ensure we protect the personal information we have access to, we implement appropriate controls to respect the fundamental rights and freedoms of our customers. Among others, we implemented the following measures:

• Use OneTrust to assess security and privacy by design, provide assurance and assess the impact on privacy.
• Implement a data loss prevention tool to track the location and monitor the use of personal information to prevent unauthorised use and access.
• Use Riskconnect to record, manage and report privacy risks.
• Deploy a vendor risk management tool during supplier reviews to ensure that suppliers meet our privacy and security policy requirements.
• Ensure that data is only shared when absolutely necessary. We also review data-sharing initiatives and stop sharing information when it is no longer necessary.
• Use online channels to increase transparency.
• Do not share personal data unless required by law.
• Implement appropriate security measures that control the access of employees who can view data sets.
• Employ suitably qualified people to enforce cyber resilience and ensure our networks to remains secure.