Company: INGVF
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001628280-25-010764
Chunk: 92

Company: ING GROEP NV
Filing Date: 2025-03-06
Form: 20-F
Item: Item 4
Chunk 92
---
. Potential material impacts are identified and addressed by relevant data protection risk assessments such as: 
•the Data Protection Impact Assessment – performed at processing activity level and allows for an in-depth scrutiny of personal data processing activities in line with applicable regulations and data protection principles; 
•the Legitimate Interest assessment – performed in order to assess whether ING can rely on legitimate interest as a lawful basis in case of certain personal data processing activities; in the case of this assessment the legitimate interests of ING are considered and balanced against the interests and rights of individuals in scope of the processing; and
•the Transfer Impact Assessment – performed in case personal data is transferred to a non-EEA country; in this case the soundness of contractual and technical protective measures and controls is assessed. 
All assessments mentioned lead to concrete risk identification and impact mitigation measures which are implemented on a granular level (business process or IT asset-level). This enables ING to continuously identify, manage and limit relevant data protection risks, as data protection risk assessments represent an integral part of defining new business processes or introducing changes to existing ones. 
Equally, personal data protection considerations are assessed and documented at product level, within the PARP process. Furthermore, the data protection framework consists of policies and control standards which are subject to continuous monitoring and in alignment with our risk based approach subject to periodic assessment and measurement.
In the case of security incidents impacting personal data (e.g. data breaches) it is our policy to take the necessary containment and mitigation measures as soon as possible after identifying such an occurrence. As part of this policy we assess related data protection risks and impacts and determine whether external reporting to supervisors is required, ensuring compliance with regulatory requirements. Depending on the impacts and risks related to the incident, we undertake ‘lessons learned’ sessions to enhance workflows to prevent similar future occurrences in order to improve the protection of customer personal data. These lessons learned take into account, first and foremost, the potential or actual impact of a data breach occurrence on affected customers. 

ING Group Annual Report 2024 on Form 20-F 

Contents       Part I         Part II        Part III       Additional information        Financial statements    
The effectiveness of our data protection and retention controls is monitored and tested periodically as part of the ING Key Control Testing framework. Data protection and retention controls are managed in line with implemented data protection governance. Relevant business process asset and contract owners are supported in identifying and managing data protection and retention risks, including by implementing appropriate mitigation measures, by dedicated first- and second-line teams, the