Company: HBCYF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001089113-25-000040
Chunk: 151

Company: HSBC HOLDINGS PLC
Filing Date: 2025-02-20
Form: 20-F
Chunk 151
---
 must be applied by all our global businesses and functions. Our privacy principles are available at www.hsbc.com/ who-we-are/esg-and-responsible-business/ managing-risk/operational-risk. We conduct regular employee training and awareness sessions on data privacy and security issues throughout the year. This includes mandatory training that is updated regularly for all our global colleagues, with additional training sessions where needed to keep up to speed with new developments. Where relevant, we encourage our data privacy employees to obtain external accreditation. We provide transparency to our customers and stakeholders on how we collect, use and manage their personal data, and their associated rights. Where relevant, we work with third parties to help ensure adequate protections are provided, in line with our data risk policy and as required under applicable data privacy laws. We offer a broad range of channels in the markets where we operate, through which customers and stakeholders can raise concerns about the privacy of their data. Our dedicated privacy teams report to senior management on data privacy risks and issues, and provide oversight for global data privacy programmes. We review data privacy regularly at multiple governance forums, including at Board level, to help ensure there is appropriate oversight by senior executives. Data privacy laws and regulations continue to evolve globally. We continually monitor the regulatory environment to ensure we respond appropriately to any changes. As part of our three lines of defence model, our Global Internal Audit function provides independent assurance as to whether our data privacy risk management approaches and processes are designed and operating effectively. In addition, we have established data privacy governance structures and continue to embed accountability across all businesses and functions. We continue to implement industry practices for data privacy and security. Our privacy teams work closely with our data protection officers, industry bodies and research institutions to drive the design, implementation and monitoring of privacy solutions. We conduct regular reviews and privacy risk assessments and continue to develop solutions to strengthen our data privacy controls. We have procedures to articulate the actions needed to deal with data privacy considerations. These include notifying regulators, customers or other data subjects, as required under applicable privacy laws and regulations, in the event of a reportable incident occurring. Intellectual property rights practices We have a Group intellectual property risk policy, supported by controls and guidance, to manage risk relating to intellectual property. This is to help ensure that commercially and strategically valuable intellectual property is identified and protected appropriately, including by applying to register trademarks and patents and enforcing our intellectual property rights against unauthorised use by third parties. Our intellectual property framework also helps us avoid infringement of third-party intellectual property rights, supporting our consistent and effective