Annex 1a

After Annex 1, the following Annex is added:

Legal and Regulatory Compliance

preventing, detecting or investigating fraud and other criminal activities;

ensuring workplace safety and security (eg, CCTV monitoring in public areas of the workplace or monitoring premises with sensitive operations);

conducting audits or compliance checks;

reporting illegal activities or threats to public safety to authorities;

cooperating with authorities in situations of emergency.

Business Operations and Management

ensuring the proper functioning of equipment, IT systems or infrastructure;

ensuring network and information security (eg, preventing unauthorised access or cyberattacks) and preventing misuse of services or systems (eg, detecting bots or spam);

protecting the controller’s or a third party’s assets, reputation, or intellectual property;

establishing, exercising, or defending legal claims;

monitoring business performance or productivity.

Research and Development

conducting scientific or historical research;

improving products or services (eg, based on customer feedback);

developing new technologies or services (eg, training, validating or testing of artificial intelligence);

clinical trials;

archiving or statistical activities in the public interest.

Distribution and Marketing

ensuring seamless transactions and user experiences on websites or apps;

maintaining customer records for service continuity;

conducting market research or customer satisfaction surveys;

measuring the effectiveness of marketing campaigns.

Business Transactions

transfers of employee, customer or supplier files within a group of companies;

carrying out mergers, acquisitions, or similar business transactions;

conducting due diligence in business transactions;

assignment of claims, or provision of claims as a security, within common financial transactions.