The programme of compliance with the European Regulation on Personal Data Protection (GDPR) consolidated a Group Privacy Governance Model which constitutes the organisational and control framework of reference within which roles and responsibilities are identified on the one hand, and the methods for implementing the basic principles of Privacy at Acea are identified on the other, with a preventive risk-based approach supported by a continuous monitoring process and periodic reviews.