Company: ADZCF
Filing Date: 2025-03-13
Form Type: 20-F
Source: 0001159508-25-000020
Chunk: 104

Company: DEUTSCHE BANK AKTIENGESELLSCHAFT
Filing Date: 2025-03-13
Form: 20-F
Chunk 104
---
 General Data Protection Regulation (“GDPR”), became applicable in the European Union on May 25, 2018. It relates to data protection and privacy rights of individuals within the European Union and addresses the export of personal data to other jurisdictions. The GDPR primarily aims at giving individuals control over their personal data and to unifying the regulatory environment for cross-border business. The GDPR contains provisions and requirements pertaining to the processing of personal data of individuals and applies to businesses inside the European Union that are processing personal data. The regulation furthermore applies to businesses outside of the European Union if goods or services are offered to data subjects in the European Union, or if the behavior of data subjects in the European Union is being monitored. The GDPR imposes compliance obligations and grants broad enforcement powers to supervisory authorities, including the potential to levy significant fines for non-compliance. For the U.S., Deutsche Bank maintains a cyber security and data privacy program that complies with the Gramm Leach Bliley Act as well as SEC and New York Department of Financial Services rules.

| 61 |

| Deutsche Bank                   |
| Annual Report 2024 on Form 20-F |

Under the German Banking Act ( Gesetz über das Kreditwesen) and the BaFin’s Minimum Requirements for Risk Management for Banks ( Mindestanforderungen an das Risikomanagement) together with the BaFin’s Supervisory Requirements for IT in Financial Institutions ( Bankaufsichtliche Anforderungen an die IT), information security needs to be an integral part of a financial institution’s IT strategy and risk management. The BaFin requires that financial institutions establish a comprehensive information and cyber security program, define standards, implement controls and adhere to their resulting security policies and standards in accordance with evolving business requirements, regulatory guidance, and an emerging threat landscape. Information security risk management is part of vendor risk management for any procurement if information technology or outsourcing activity include the use of new technologies like cloud services. Information security risk (also referred to as cyber risk) is a component of operational risk assessed in the context of the SREP under Guidelines on Information and Communication Technology Risk Assessment issued by the EBA, which expects financial institutions to protect the confidentiality, integrity, and availability of customer data and information assets. Such guidelines are complemented by the EBA’s Guidelines on ICT and Security Risk Management. Going forward, the recently adopted Digital Operational Resilience Act (“DORA”), which applies from January 17, 2025, and the pertinent technical standards, introduce a comprehensive framework setting out rules on the digital operational