Mitigation actions adopted The programme for the protection of personal data adopted by the Group is based on the following fundamental elements that involve the entire business structure: y use of a model based on mapping the personal data processed by business functions and keeping a register of processing activities; y definition of a governance model designed to comply with the requirements of the GDPR and other emerging data protection requirements; y evaluation and implementation of adequate technical and organisational measures to ensure a level of security appropriate to the risk, partly with the help of new tools such as the data protection impact assessment introduced by the GDPR; y definition of the communications and training materials specifically reserved for the roles identified with the data protection organisational model.