The operations of NS involve extensive data processing, innovative technology and collaborative ventures in which personal data is exchanged. It is our responsibility to ensure that the personal data is processed in the appropriate manner. This responsibility is all the greater given the position and role of NS as a large company at the heart of society. In accordance with the Dutch Personal Data Protection Act, the Executive Board of NS bears ultimate responsibility for full compliance with the applicable privacy legislation.

The processing of personal data has to meet increasingly stringent requirements. The General Data Protection Regulation comes into effect on 25 May 2018. A realignment of the NS privacy policy was therefore carried out last year and we started an implementation programme to make sure NS complies with this new legislation. We are doing this by looking at processes, organisation, systems and conduct.