Adopted by the Executive Committee of the Board of Directors of the Chamber

1 This Policy will be reviewed annually by The Chamber’s Executive Committee (“Exco”), the first such review taking place before 31 March 2019. Each review shall ensure that the Policy is updated to reflect current legislation, relevant regulations and best practice.

2 The Exco shall be responsible for the implementation and observance of the Policy and shall appoint from time to time an employee or consultant of the Chamber to fulfil the duties of [data protection officer] of the Chamber. The Exco shall also frame rules from time to time to achieve compliance with this policy.

3 Secretary-General (“SG”) shall ensure that all relevant employees of the Chamber and those directors having an executive or supervisory role within the Chamber are aware of and are kept informed of developments relating to the matters covered by this Policy.

4 It is noted that: a) The EU General Data Protection Regulation (GDPR) is designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy. b) Any breach of GDPR is serious and can lead to substantial penalties, fines and sentences.

5 The UK legislation and regulations relating to GDPR is contained in The EU General Data Protection Regulation (GDPR) (EU 2016/679, it replaces the Data Protection Directive 95/46/EC. The new legislation comes into effect on 25 May 2018.

6 The Chamber is responsible for taking all necessary steps to ensure that risks relating to data protection are eliminated. 7 All employees and directors of the Chamber must be alert to the risks which the Chamber faces with respect to GDPR. 8 in addition to paragraph 7 above, the need is recognised properly to identify (in accordance with the Legislation) the individuals and corporations, and data to which GDPR applies.