Protecting privacy and customer confidentiality 

NatWest Group has adopted a layered and accessible approach which follows regulator guidance to provide information about how we use our customers’ and colleagues’ data in the privacy notices on our websites. Privacy notices are aligned to each part of our business and can be found on our website. Links to some privacy notices are provided below:

• National Westminster Bank plc
• Royal Bank of Scotland plc
• Coutts & Co

Privacy notices are subject to regular review to ensure they remain up to date and accessible to users across all digital platforms. 

All colleagues and contractors are required to undertake annual mandatory privacy and client confidentiality training. Training topics include:

• Our privacy and client confidentiality obligations.
• Privacy considerations for new projects and systems.
• How colleagues can recognise and respond to requests from individuals to exercise their data rights.
• What to do in the event of a data breach.

The privacy and client confidentiality training module is updated annually with new topics and learnings from the previous year. Job-specific training is also provided as necessary for colleagues, for example training on Artificial Intelligence for the benefit of our privacy colleagues. Our privacy specialists are also required to complete privacy qualifications to undertake their role.

Our colleagues responsible for a privacy breach may be subject to disciplinary action under our Disciplinary Policy where appropriate. We review each breach on its facts and look to foster a culture where individuals are encouraged to report, understand the serious consequences of a data breach, and actively learn from their errors and improve their day to day working practices. 

NatWest Group’s cybersecurity risk management forms part of NatWest Group’s overall enterprise-wide risk management framework (EWRMF), with management of cybersecurity part of Natwest Group’s wider operational risk management.

NatWest Group has a comprehensive set of layered security defences to protect against new and emerging threats. These are tested at least annually by both our in-house security testing team and leading experts in the cybersecurity industry. To ensure we continue to defend against new and emerging threats, we have a series of programmes that develop and improve the deployed defences.

NatWest Group follows a pan-Group approach to Operational Resilience, with Business Continuity being one of the core resilience capabilities. Business Continuity requirements include defining roles and responsibilities, assessing the business impact of disruption to critical processes, defining business recovery strategies / procedures, and testing the effectiveness of continuity plans. Business Continuity plans must be reviewed and tested annually, or sooner if there is a material change. In addition, the Group maintains a documented Incident Management Framework to support the response to high priority incidents, including those that are cyber security related, by providing rapid and agile command, co-ordination and escalation protocols. Incident Management response capability is validated on an annual basis. Incident Management exercises are also undertaken to validate the invocation and adequacy of the Senior Control Groups.

Board and executive oversight:

The Board and executive management are engaged in our security strategy through regular reporting from the Digital X business, led by  NatWest Group’s Chief Information Officer (CIO) who is the accountable executive for information and cybersecurity. The Group’s Chief Information Security Officer reports into the CIO and  presents an information and cybersecurity update to the Executive Risk Committee and Group Board Risk Committee annually as a minimum. Matters are escalated to the Board as required.

Audits:

An external audit is completed on an annual basis as part of NatWest Group’s wider financial audit requirements. Internal audits are completed on an ongoing basis and reported monthly to the Group’s Security Risk Committee.

Colleague engagement:

Our internal learning modules provide training and awareness on information and cybersecurity risks that every colleague and contractor must complete annually. These are supported by email communications and further information is also available on our intranet.

Colleagues also receive job-specific training, for example, our Security team attends courses with the Centre for the Protection of National Infrastructure and the NCSC, as well as having opportunities to gain professional qualifications. There are clear escalation routes in place for colleagues to report any cyber or information security concerns.