Abbott Laboratories
Data Protection Compliance Statement(for use with customers in the European Economic Area and the UK only)
March 9, 2023
Abbott is committed to developing its products and services in accordance with applicable laws
and regulatory requirements, including those relating to data protection.
Prior to the enactment of the General Data Protection Regulation (“GDPR”), Abbott met therequirements of the EU Data Protection Directive and relevant national legislation. Thismeans:§§§§

Abbott published detailed privacy notices for its products and services. These privacy
notices explained to affected individuals how Abbott processed their personal data.
Where applicable, Abbott also developed mechanisms allowing individuals to provide
consent for the processing of their personal data.
Abbott established processes and procedures to honour individuals’ data protection
rights. Such rights included, for example, the right of access, the ability to unsubscribefrom communications, and the right to have accounts deleted.
Where required, local Abbott affiliates registered with data protection authorities. Abbott
notified data protection authorities of its data protection practices and procedures andobtained relevant authorisations, where required under local law.

Abbott did a comprehensive review of its data processing practices and procedures before theGDPR became effective on 25 May 2018. This review was designed to ensure that Abbott’s
personal data processing complies with GDPR. In addition to actions already taken, Abbottenhanced its privacy protection in the following ways:
§§
§
§
§
§
§
§

Appointing an EU and UK data protection officer (https://www.abbott.com/eudpo.html).
Reviewing and updating relevant Abbott product, service, website and mobile applicationprivacy notices and disclaimers to ensure Abbott clearly explains to individuals how theirpersonal data is processed.
Refreshing the methods by which it obtains consent from individuals when applicable (forexample, to receive direct marketing communications).
Enhancing policies, procedures and technical capabilities to respond to individuals’
subject access requests.
Updating contracts with third parties in accordance with GDPR requirements.
Delivering tailored and comprehensive training to Abbott employees about the impactand importance of GDPR.
Strengthening and standardizing data protection impact assessment and privacy bydesign programmes for new product and service launches or innovations.
Updating internal policies, procedures and controls to ensure that they incorporate GDPR
requirements and obligations.

The Data Protection Act 2018 and the UK GDPR is the UK Government’s implementation ofthe GDPR. These legislations are a close copy of the GDPR and demand the same standards ofdata care as the GDPR.

Abbott has also put recognized procedures and safeguarding measures in place to secure,encrypt and maintain the integrity of any personal data that is transferred to countries outsideof the European Economic Area (EEA) or the UK. These measures include the use of EU
Standard Contractual Clauses. Following the invalidation of the EU-U.S. Privacy Shield,
diligence checks are also carried out to ensure that any countries outside of the EEA or UK
provide essentially equivalent protection to that of the GDPR.
A copy of our current privacy notice is available online at https://www.abbott.co.uk/privacypolicy.html.
If you have any questions about this GDPR Compliance Statement please contact us:
https://www.abbott.com/eudpoform.html or EU-DPO@abbott.com; or our German Data
Protection Officer: Data_Privacy_Officer.de@abbott.com
Abbott Global Privacy

Page 2 of 2