The programme for the protection of personal data adopted by Prysmian is based on the following fundamental elements that involve the entire business structure: y Implementation of a “data centric” model, by mapping the personal data processed by business functions and keeping a register of processing activities; y Definition of a governance model designed to comply with the requirements of the GDPR and other emerging data protection requirements, marked by: � an organisational structure that assigns an advisory and monitoring role to the data protection officer (DPO) in the management of personal data, delegating duties and the related responsibilities to the roles that actually process that data; � a series of policies and documents that support the model (business policies, information sheets, internal appointments, clauses applicable to suppliers etc.); y Evaluation and implementation of adequate technical and organisational measures to ensure a level of security appropriate to the risk, partly with the help of new tools such as the data protection impact assessment introduced by the GDPR; y Definition of the communications and training materials specifically reserved for the roles identified with the data protection organisational model, so that all roles involved are aware of the renewed regulatory obligations and take steps to implement all specified requirements; y Update of the video surveillance systems, with particular reference to the new European guidelines and the regulations applicable in Italy.