In to our data privacy and information security processes: We instituted an in‑depth privacy and security assessment of our key products to ensure their functionality is updated for current requirements, and developed plans to mitigate identified areas of risk; We established a detailed GDPR plan to ensure we are focused on the various activities required to adapt our program to meet the changes due to come into effect in May 2018; We developed our vendor management processes and expanded our use of privacy impact assessments to encompass vendors and new programs; We developed targeted training and policies for particular business areas and teams to address their key risks; and We established a set of product privacy requirements, which have been implemented into the product development process to support privacy by design.