Security and incident management
Incident management
We may be required to process personal data both before and in the event of a crisis situation or incident in DNB. This will be personal data that is related to an incident such as violence, threats, unwanted behaviour or an accident.
Personal data processed in this context is related to the incident itself. The incidents may contain both general personal data and special categories of personal data, such as health data.
The purpose of the data processing is to detect and manage a crisis situation.
We are legally obliged to process personal data for this purpose, and the legal basis is the regulatory statutory requirements that apply to the financial industry regarding security and incident management.
We store events in access-controlled internal information systems and retain the personal data for as long as necessary to fulfil the purpose of the processing. Some logs are kept for 10–15 years in accordance with our internal archiving routines.
When we collect and process information about you, you have several rights under the data protection rules and legislation. This includes the right of access, the right to data portability, the right to rectification of any errors and the right to erasure, which means that we must, on our own initiative, delete information that is no longer necessary for the purpose of the processing. We will always consider any objections you may have to the processing of your personal data, and we will follow up any request you may make to opt out of direct marketing.
Read about how you can exercise your data protection rights on our privacy pages under ‘Your rights’.
DNB Livsforsikring AS is responsible for the processing of your personal data.
- Identification data
- Special categories of personal data collected from the data subject during incident management, including health data
We may share personal data within the Group for internal processing purposes. In addition, we may share information with external authorities such as the police. We may also share data with suppliers who process personal data on our behalf.