Data privacy is a fundamental component of the Bank’s governance pillar and demonstrates its commitment to accountability, transparency, ethical data management, and responsible stewardship of information assets. At the same time, respecting individuals’ rights forms an integral part of the social pillar of environmental, social, and governance (ESG), which addresses human rights, diversity and inclusion, employee well-being, and fair treatment. Through a structured privacy governance framework, the Bank ensures that personal data is processed in a lawful, fair, and secure manner, while safeguarding the rights and trust of staff, clients, counterparties, and other stakeholders. Effective privacy risk management strengthens institutional resilience, supports sound decision-making, and contributes to the highest standards of integrity and good governance expected of an international public institution.

Policy Framework

The data privacy program is established on a comprehensive governance framework. This includes the Policy on Personal Data Privacy (PPDP), the Directive on Personal Data Privacy (DPDP), and the Instruction on Personal Data Breach Management. Before the establishment of the data privacy program, the Bank approved the Directive on the Information Classification System, which established provisions for a robust framework for information protection and the responsible management of personal data.

Data Privacy Officer

The Bank has a designated Data Privacy Officer (DPO), similar to other multilateral development banks and consistent with international best practices. The DPO is responsible for overseeing the implementation of the PPDP and the DPDP, providing independent advice on data privacy matters, monitoring compliance with the Bank’s privacy requirements, and coordinating privacy-related activities across business units. The DPO serves as the point of contact for privacy governance, supporting management in identifying and managing privacy risks while fostering a culture of accountability and responsible data handling throughout the organization.

Board Reporting and Oversight

To ensure transparency and uphold AIIB’s commitments as an international public institution, the Bank’s management submits an annual privacy report to the Board of Directors on the key areas of the data privacy program, including personal data breaches, training and awareness initiatives, privacy risk assessments, records of processing activities, privacy impact assessments, audit findings, emerging regulatory developments, and ongoing enhancement measures.

Data Privacy Program Implementation

• Privacy by Design and Privacy Impact Assessment

The Bank ensures that privacy-by-design principles are integrated into all business processes, system implementations, and operational project life cycles through a robust privacy program. Privacy impact assessments are conducted for new initiatives, systems, or significant changes involving personal data to identify privacy risks and ensure that appropriate controls are incorporated in the earliest stages of design and implementation. Privacy requirements, including data minimization, access controls, retention management, and secure processing practices, are embedded into the system development life cycle and operational processes. The Bank has identified sensitive personal data within records retention schedules and applies the minimum retention periods necessary to fulfill business and legal requirements.

The DPO works closely with the Bank’s cybersecurity and technology teams to ensure the alignment of privacy and information security controls. This collaboration supports the implementation of technical and organizational safeguards, including access management, encryption, monitoring, vulnerability management, and incident response capabilities, to protect personal data against unauthorized access, disclosure, alteration, or loss.

• Data Loss Prevention

To further strengthen the protection of personal data, the Bank utilizes data loss prevention (DLP) technologies and monitoring mechanisms to help identify, prevent, and mitigate unauthorized disclosure or transfer of sensitive information. DLP controls support compliance with the Bank’s information classification and privacy requirements by detecting high-risk activities, enhancing visibility over personal data processing, and assisting in the prevention of accidental or intentional data leakage.

• Data Breach Notification

Personal data breach incident response is governed by the Instruction on Personal Data Breach Management, which establishes clear procedures for identification, reporting, containment, assessment, notification, and recovery. In the event of a validated personal data breach, the Bank notifies affected internal and external data subjects without undue delay, in accordance with its privacy governance requirements.

• Privacy Training and Awareness

AIIB provides mandatory privacy training and organizes awareness sessions for Bank personnel and third-party service providers through coordinated learning, campaigns, events, and internal communications. Where required, the Bank obtains explicit consent from data subjects, consistent with the principles of lawful, legitimate, and fair processing of personal data.

Data Subject Access Requests

In accordance with the PPDP, the Bank recognizes the rights of data subjects to access, correct, and, where applicable, request the deletion of their personal data. Data subject access requests are facilitated through the website and processed within established timelines.

Audit and Risk Review

The effectiveness and maturity of the privacy program are supported through periodic risk assessments, privacy reviews, and internal audits. These activities help evaluate compliance with the Bank’s privacy framework, assess the effectiveness of implemented controls, identify emerging risks, and drive continuous improvement of privacy practices across the organization.

Third-party Privacy Risk Management

The Bank has established requirements to mitigate risks associated with third parties processing personal data on its behalf. Personal data protection obligations are incorporated into contracts and/or AIIB’s general terms and conditions of corporate procurement. Depending on the nature of the processing activities, third parties may be subject to privacy due diligence, contractual confidentiality obligations, security requirements, and ongoing oversight to ensure that personal data is handled in a manner consistent with the Bank’s privacy framework and applicable contractual commitments.