Company: BBVXF
Filing Date: 2025-02-21
Form Type: 20-F
Source: 0000842180-25-000010
Chunk: 86

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-21
Form: 20-F
Item: Item 4
Chunk 86
---
) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) aims to achieve effective protection of personal data by providing natural persons in all EU member states with the same level of legally enforceable rights and obligations regarding personal data and imposing responsibilities on data controllers and processors to ensure consistent monitoring of the processing of personal data. Organic Law 3/2018, of December 5, on the protection of personal data and guarantee of digital rights implemented the GDPR into law in Spain.
For BBVA, the GDPR has affected directly the way we manage internal and external processes. Due to the incremental use of new technologies in almost any process carried out by the Group, where personal data of individuals are usually involved, we have had to introduce multiple changes. The GDPR’s accountability requirements to comply with data protection principles and to be able to demonstrate such compliance, have led to an increased uptake of implementing and revising our privacy management processes, from the way in which consent is obtained from the client, to the implementation of processes to put into effect new rights.
GDPR introduces a risk-based approach to data processing (the higher the risk associated with the data processing, the higher the standard for the evidence to be submitted in order to prove compliance with the GDPR), including the preparation of Data Protection Impact Assessments for each high-risk data processing activity, “privacy by design” requirements (where data protection is integrated in the technology when created) and the legitimate interest balancing test (to weigh the reasons a business holds personal data against the data rights of an individual). This seeks to ensure appropriate risk-based prioritization of mitigations and controls and a more effective data management program based on actual risk.
Furthermore, GDPR obligations and requirements to notify breaches to authorities and individuals under different circumstances meant that BBVA had to review and enhance our existing data security measures and programs and also to update BBVA’s breach response plans and notification procedures, while training staff and management.
Mexico
BBVA’s operations in Mexico are highly regulated. The Mexican regulatory framework for financial and banking activities aims to ensure the stability of the financial system and combat money laundering, as well as to provide consumer protection and transparency in the provision of financial services.
Financial, Deposit and Credit Services 
The provision of financial and deposit products is mainly regulated in the Banking Law and provisions issued by the National Banking and Securities Commission (Comisión Nacional Bancaria y de Valores