17

Principle: We protect our people and assets and ensure appropriate protection and handling of data.

We comply with the requirements of relevant data protection laws and respect individuals' privacy rights. These laws require that we make sure individuals can exercise their rights in relation to their own personal information. We maintain policies, processes and systems to safeguard the privacy of individuals and protect their personal information as if it were our own. If personal information is accidentally or deliberately destroyed, lost, altered, disclosed or accessed, we may need to report it to the relevant regulator within a very short timeframe.

We require that any third parties that process personal information on our behalf do the same. We take extra care when processing sensitive information, including racial and ethnic origin, political opinions, religious and philosophical beliefs, a person's sex life or orientation, health information, criminal records and trade union membership.

If our colleagues don’t follow the relevant laws, we could be subject to legal proceedings. Breaches of the law could also damage our reputation or commercial interests, and any involved directors could be prosecuted or disqualified from holding office. There could also be personal criminal consequences if colleagues willfully or recklessly break the law.

Security is everyone’s responsibility. It can affect us all, both in our work and personal lives. Being vigilant and following appropriate practice helps us protect ourselves and Drax. To help protect Drax from threats, we configure our processes, systems, data and assets (e.g. laptops) with security controls to protect valuable technology, intellectual property and commercially sensitive information from unauthorised use and disclosure. Any attempt to reconfigure these measures, unless you’re specifically authorised to change them, will be considered a disciplinary matter.

As a Drax colleague or non-permanent worker, you’ll have access to business information about Drax, our companies, people, locations, suppliers, customers and business partners. While some of that information will be publicly available, the majority will be confidential and require protection. Protecting confidential information is everyone’s responsibility at Drax.

'Confidential information' means any information or material belonging to a member company within the Drax Group or which is in the possession of a member company with the Drax Group. It can also be information that you only know because you're a Drax colleague. Confidential information might be electronic, spoken, appear in writing or any other format.

If you're working on a confidential project, you may be added to a 'Confidentiality List' for that project. As well as preserving the confidentiality of that project, you'll also need to request 'permission to deal' if you want to buy or sell Drax shares during the period you're on the Confidentiality List.

Misuse of Drax confidential information can have serious consequences, so only share it internally and only when absolutely necessary, only disclose confidential information to a third party with appropriate authorisation and use secure communications. Treat confidential information belonging to customers or other third parties in the same way.