AmazonScience/document-haystack

1with access rights requests received from individuals, obtain consent from an individual 2where required and to inform individuals about what is happening with their personal data.3Where required by law, privacy notices are provided directly by the business units and 4infrastructure functions to our customers and employees or are made available on their 5respective public websites, including the website-specific privacy notice. These notices 6provide an overview of how we process personal data and what rights individuals whose 7personal data are processed have under data protection law.8Based on the Deutsche Bank Group framework for managing non-financial risks, Group Data 9Privacy has established control requirements which DWS adheres to for mitigating data 10protection risk. These include the Data Privacy permissibility assessment of new activities 11that involve processing of personal data, for example when processing personal data using 12artificial intelligence. 13Furthermore, Group Data Privacy also assesses emerging data protection laws and 14regulations on an ongoing basis for us and, if necessary, adjusts the policy framework as well 15as the minimum control standards. The same applies to technical developments and new 16digital business models.17Key Topics 202318A key topic was the assessment of new data protection legislation in the countries where we 19do business: In 2023, the European Commission adopted its adequacy decision for the EU-US 20Data Privacy Framework which concludes that the United States ensures an adequate level of 21protection – compared to that of the EU – for personal data transferred from the EU to US 22companies participating in the Framework. Following this, the UK government introduced the 23UK-US Data Bridge which allows organizations in the UK to transfer personal data to US 24organizations certified to the UK Extension to the EU-US Data Privacy Framework. In addition, 25the Swiss Federal Act on Data Protection entered into force and India enacted the Digital 26Personal Data Protection Act with the effective date still pending. Group Data Privacy is 27closely monitoring the further development of the UK Data Protection and Digital Information 28(No 2) Bill which was reintroduced in March 2023. Where necessary, we are taking steps to 29ensure compliance with these laws.30Another key topic was the transfer of services previously performed by Deutsche Bank and its 31internal and external service providers to our own service providers. The associated 32processing of personal data required the implementation of new internal and external data 33processing agreements and associated security measures, particularly for third country 34transfers to countries outside the EU. The Data Protection department was involved in 35reviewing the contracts and assessing the appropriateness of the technical and organizational 36measures chosen to protect personal data.37Employee Awareness and Training38Training for employees on the impact of data protection laws on our day-to-day operations is 39a key factor in ensuring effective data protection in all operational processes. Mandatory data 40privacy training is required of all employees. In addition, employees are made aware of data 41protection through internal online events and intranet articles. Group Data Privacy organised 42several regional webinars in 2023 to raise awareness of the importance of data protection 43and the handling of personal data. Employees were also made aware of how to obtain 44internal support for data protection issues, what rights individuals have regarding data 45protection, best practices for the protection of personal data, trends in data protection, and 46the consequences of poor data protection practices.47No Personal Data Breaches with Material Impact on Individuals48For 2023, we did not identify any personal data breaches with a material impact on 49individuals. Our reporting processes and structures aim to ensure that data protection 50breaches are promptly escalated and incidents are assessed and dealt with immediately. 51Should a data protection breach occur, follow-up measures are taken as part of the incident 52management process. If necessary, the affected individuals will be informed as well as the 53competent data protection supervisory authorities.54        55To our Shareholders Summarised 56Management Report57Consolidated 58Financial Statements Compensation Report Corporate Govern-59ance Statement60Supplementary 61Information DWS 2023 Annual Report62 63Compliance and Control6462 Data Protection