The Scotiabank Group Member is accountable for all personal information in its possession or custody, including any personal information disclosed to third parties for processing or other administrative functions. Each Scotiabank Group Member has established policies and procedures to comply with this code, and has designated one or more persons to be accountable for compliance.

1.1 The Scotiabank Group Member's senior management has accountability for protecting its customers' personal information. Senior management, however, delegates the day-to-day procedures of compliance to others.

1.2 The Scotiabank Group Member will identify internally and to its customers the person or persons who are responsible for overall privacy protection and compliance.

1.3 The Scotiabank Group Member is accountable for personal information in its possession or custody that is disclosed to a third party for processing or other administrative functions. The Scotiabank Group Member will safeguard this personal information through means such as a contract or other agreement with the relevant third party.

1.4 To practice the principles of this code, the Scotiabank Group Member:

• Has policies and procedures to protect the privacy of personal information.
• Has policies and procedures to receive and respond to customers' questions and complaints.
• Informs customers and staff of the Scotiabank Group Member's policies and procedures.
• Trains staff to understand and follow the Scotiabank Group Member's policies and procedures.

The Scotiabank Group Member also oversees compliance with these policies and procedures through normal risk-based cyclical audits, and through compliance policies and procedures.