Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 142

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 142
---
 | Sustainability statement |     | Corporate governance |     | Economic and financial review |     | Riskmanagement and compliance |

privacy laws at all times, with an ethical and transparent management of personal data to enable individuals to exercise greater control over their data.

We apply measure s to obtain and use only the data that is strictly necessary to process personal data for legitimate purposes. The aim of these technical and organizational measures is to preserve the confidentiality, integrity, availability and resilience of the systems and services that we use to process data; and thereby to achieve the correct protection of data subjects’ rights and freedoms; and to boost individuals’ and broader society’s trust.

We created our compliance programme following the privacy standards to manage data protection risk correctly. It is based on:

• local subsidiaries’ responsibility to abide by the General Data Protection Regulation (GDPR) and/or local regulation on data protection;

• a solid governance model consisting of:

1. corporate and local data protection policies.

2. a data protection officer (DPO) and/or privacy champions in each unit. We formally disclose appointees to local authorities.

3. a corporate oversight programme based on the monitoring of management indicators; annual reviews; and an annual monitoring forum sponsored by the Group Chief Compliance Officer where our units report on compliance status, key risks and focal points, and other key data protection matters.

Other measures that strengthen our data protection management are:

• a common, regular monitoring and reporting model for the units, including meetings that we document in minutes;

• procedures to manage security-related incidents and the risks that stem from the potentially unauthorized use of personal data. We also have specific plans of action, where required, which the corresponding areas manage;

• cooperation with third-party service providers that must comply with data protection regulation. All data processors are subject to a suitability test that we monitor through management indicators and review regularly;

• reviews on our compliance with data protection laws, which our Internal audit area performs as part of its annual programme;

• corporate tools that help us manage data protection-related tasks by bringing together and monitoring control information through indicators and the annual review programme. For instance, we regularly update our data processing inventory and report on indicators and security incidents;

• special training for DPOs and privacy champions as well as corporate initiatives and the sharing of best practice among units. In 2024, we ran a refresher course on data privacy by an external provider and initiatives on the back of it;

• employee training and awareness campaigns on data protection, which form part of our mandatory annual curriculum and that we monitor through