Protecting privacy and customer confidentiality 

NatWest Group has adopted a layered and accessible approach to providing information about how we use our customers’ and colleagues’ data in the privacy notices on our websites. This information is subject to regular review to ensure it remains up to date and accessible to users across all digital platforms. 

All colleagues and contractors are required to undertake annual mandatory privacy and client confidentiality training. Each year, we also engage with our suppliers to understand the privacy governance arrangements they have in place (including policy, mandatory procedures, training and awareness) and review the responses to ensure that satisfactory controls exist. Training topics include:

• our privacy and client confidentiality obligations
• privacy considerations for new projects and systems
• how colleagues can recognise and respond to requests from individuals to exercise their data rights
• what to do in the event of a breach

For more information on privacy and confidentiality training, see page 33 of our 2023 ESG Disclosures Report

We aim to embed privacy by design and default. This requires the integration of data protection into processing activities, business practices, products and services from the design stage of a product and through its lifecycle. We have set up a privacy by design and default project which continues to embed these requirements. Data Protection Impact Assessments are an integral part of data protection by design and default. These assessments help us to design more efficient and effective processes for handling personal data.