19 Table of Contents Introduction & Our Approach Operating Responsibly Investing in Our People Diversity, Equity & Inclusion Environmental Sustainability Social Impact Data & Frameworks CORPORATE GOVERNANCE ETHICS RISK HUMAN RIGHTS SUPPLY CHAIN PRODUCT SAFETY GUEST SAFETY INFORMATION SECURITY PRIVACY DIGITAL WELLNESS RESPONSIBLE ADVERTISING JOURNALISTIC INTEGRITY ARTIFICIAL INTELLIGENCE TAX STRATEGY INFORMATION SECURITY PRIVACY DIGITAL WELLNESS & RESPONSIBLE CONTENT TC-IM-230a.2 TC-IM-220a.1 Learn more in our Data & Frameworks Learn more in our Data & Frameworks Learn more in our Data & Frameworks Information security, including cybersecurity, is an We have policies designed to enhance the protection of the We believe the digital world should be a safe space for kids and important aspect of operations as it protects systems, personal information of our customers, guests, non-guests, families to engage, learn, explore, and express themselves. We strive networks, and programs from digital attacks. The including job applicants and third-party businesses, and our to produce positive, respectful, high-quality content and experiences company’s information security management system employees. Our global privacy program is based on the designed for individuals, children of all ages, and families. is designed to secure the Disney Global Network’s principles of privacy by design, accountability, transparency, We deliver content through multiple channels, including our digital environment as we grow our businesses. Our and giving individuals meaningful controls over their own digital offerings. Our internal policies and practices information security program continues to be informed personal information. We regularly assess and update our promote safety within our digital experiences. We provide by the National Institute of Standards and Technology program to take into account applicable requirements of parents and caregivers with controls and recommendations so Cybersecurity Framework and other recognized new privacy laws and regulations around the world and to that they can choose the content and experiences that are right information security frameworks, including the core keep up with rapid advancements in technology and new for their families. principles set forth therein. business initiatives. In 2023, this included working with The Audit Committee of our Board of Directors reviews partners across our businesses to update our program to We also support children’s digital well-being through our Digital the company’s cybersecurity and data security risks and re昀氀ect requirements that went into effect in California, Wellness Grant Program. We provide funding to nonpro昀椀ts and mitigation strategies. Day-to-day management is the Virginia, Colorado, Utah, and Connecticut. other organizations working to educate children, parents, caregivers, responsibility of our Information Security function, We provide privacy training to our employees and have and teachers around the globe about digital citizenship. Grantees which reports to our Chief Financial Of昀椀cer. This team incorporated privacy topics into the company’s Standards of offer expertise in areas of focus including digital literacy and periodically updates the Audit Committee on the Business Conduct and information security trainings—both resilience, privacy, responsible internet use, and critical thinking. company’s cybersecurity risks and mitigation strategies. of which are required on a recurring basis. We also regularly In 2023, we supported 20 organizations through digital wellness conduct specialized trainings for applicable employees on education grants. Our initiatives supported peer-to-peer training, how to properly handle the personal information of development of resources for parents and educators, and Read more about our approach to cybersecurity: customers, employees, contractors, and/or third parties. activities to promote mindful digital use and online safety. For Information Security Management System Day-to-day management of data privacy is the responsibility example, in Indonesia, we supported the Ganara Mariberbagi of our Global Legal, Policy, and Compliance function, Seni Foundation’s Creative Digital Camp, an initiative to educate which reports to our Chief Legal and Compliance Of昀椀cer. students, parents, and teachers across multiple provinces by giving them a thorough understanding of digital literacy and online safety through art activities. In Sweden, we supported an Learn more about the content safety Read more about our approach to privacy: organization called Friends, with a focus on its Ask Us! Youth functionalities on some of our platforms: Privacy Center Online Safety program. Working with children and youth globally, it aims to establish youth-led recommendations for Disney+ Parental Controls Page Non-Guest Privacy Policy online child safety. And in the United States, we are helping the Disney+ Parental Controls Video Guest Privacy Policy National Center for Missing and Exploited Children support authorities in responding to potential online threats facing Hulu Help Center Children’s Privacy Policy children. We also participate in industry coalitions to promote user awareness of online safety.