Company: INGVF
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001628280-25-010764
Chunk: 91

Company: ING GROEP NV
Filing Date: 2025-03-06
Form: 20-F
Item: Item 4
Chunk 91
---
 approach subject to periodic assessment and measurement. In relation to products and services, we perform periodic reviews in the context of the Product Approval and Review Process, which may lead to the remediation of a product if, for example, it is considered unfit for our customers.
Global Personal Data Protection Internal Policy
Just as we strive to enable customers to engage with ING without issue or interruption, we aim to protect the information they provide to us throughout their ING journey. The same applies for our business partners, service providers and our employees. In line with the EU's General Data Protection Regulation (GDPR) and other applicable data protection requirements, ING aims to process personal data for a specific business purpose in a fair and lawful manner, observing the rights and liberties of data subjects in scope of our activities. To fulfil this ambition, ING has implemented a Global Personal Data Protection Internal Policy (GPDP) which reflects the requirements based on laws and regulations, industry standards and ING’s internal risk appetite. This GPDP contains specific requirements and controls which ensure the necessity and accuracy of the personal data ING is processing. The GPDP helps in preventing and mitigating impacts and risks regarding the topic (data) privacy.
It is our policy to have operational flows regarding data subject rights (such as the right to access personal data, right to erase personal data which no longer needs to be retained, right to object to data processing etc.) and that these are adequately provided to all individuals whose personal data is subjected to processing. This means that ING has implemented operational flows which allow us to process requests concerning access to personal data, the amendment/correction of personal data, opposition to processing of personal data etc. in a timely manner, in line with regulatory requirements.
In line with our policies, we strive to be transparent about what we do with the personal data of customers, employees, suppliers and business partners, as well as who we share personal data with and why. We want our business entities, support functions, and the third parties that we engage with, to grant a level of protection to the data subject equivalent to that guaranteed by the GDPR, especially if personal data is transferred outside of the European Economic Area. Part of the data protection scope is that personal data is 

managed in a safe and secure manner, in line with current information security standards. More information can be found in the Privacy Statement on ing.com. 
Actions regarding Privacy
ING manages personal data protection and retention risks and impacts via the Global Data Protection and Data Retention frameworks and control standards