Iron Mountain® Policy Center Solution Enterprise Edition

Policy Center Enterprise Edition combines subscription access to Policy Center, a cloud-based retention and privacy policy management platform, with expert Advisory Services to help you comply with existing and new regulations, such as the General Data Protection Regulation (GDPR). It helps you manage privacy and retention together, so you can know your retention and privacy obligations, and show compliance.

1. Know Your Retention and Privacy Obligations. Show Compliance. ENTERPRISE EDITION IRON MOUNTAIN POLICY CENTER SOLUTION ® © 2018 Iron Mountain Incorporated. All rights reserved. Iron Mountain and the design of the mountain are registered trademarks of Iron Mountain Incorporated in the U.S. and other countries. All other trademarks and registered trademarks are the property of their respective owners.

2. EU-wide data privacy legislation requiring compliance by all organizations who do business with EU data subjects Protects the right of an EU data subject to determine whether, when, how and to whom his personal data is revealed and how it can be used S evere fines for failure to comply; up to 4% annual world turnover or €20 million, whichever is greater If GDPR compliance doesn't start with information governance , y ou'll probably fail – Forbes* You must know and show : What personal information you have, where it lives & who owns it How to treat it & how long to keep it WHAT IT IS WHAT IT DOES WHAT IT MEANS WHAT IS THE EUROPEAN UNION (EU) GENERAL DATA PROTECTION REGULATION (GDPR)? *https://www.forbes.com/sites/forbestechcouncil/2017/12/06/if-gdpr-compliance-doesnt-start-with-information-governance-youll-probably-fail/#21f637812e1e

3. 64% of organizations say the biggest barrier to GDPR compliance is the need to make comprehensive changes in business practices. McDermott Will & Emery LLP and Ponemon Institute LLC, “The Race to GDPR: A Study of Companies in the United States & Europe” 2018.

4. COMMON CHALLENGES Keeping your retention and privacy policies current to comply with changing laws globally Incurring unnecessary cost and risk by keeping information longer than required Limited or no ability to communicate policy changes to content owners and infrastructure Proving to regulators that your organization is compliant

5. WHAT IF YOU COULD… Receive expert guidance and tools to comply with the GDPR and other regulations that govern you ? Receive continuously updated retention and privacy requirements so you can keep your policy management connected and dispose of information when it’s no longer required ? Provide online visibility into the latest version of your retention schedule, privacy policies and critical information about your business processes that contain personal data?

6. THE ADVANTAGE OF MANAGING PRIVACY AND RETENTION TOGETHER Increasing privacy concerns and regulations like the GDPR are elevating the need for privacy and retention to be managed together so you can: Have a unified view of your personal data and related obligations Dispose of private information as soon as possible Reduce unnecessary exposure to data breaches

7. Combines subscription access to a cloud-based retention and privacy policy management platform with expert Advisory Services to help you comply with existing and new regulations, such as the General Data Protection Regulation (GDPR ). WHAT YOU GAIN: E xpert Advisory Services team support C ontinuously updated online portal with retention and privacy legal citations Simple explanation of requirements to support your retention and privacy decisions Filters to view record classes and types affected by privacy law T ools to document critical information about your business processes that contain personal data ( GDPR Article 30) Ability to distribute policy to content infrastructure and key stakeholders POLICY CENTER ENTERPRISE EDITION

8. RETENTION AND PRIVACY CITATIONS COLLECTED BY INTERNATIONAL NETWORK OF LAW FIRMS CONTRIBUTE INTERNATIONAL NETWORK OF HIGH QUALITY LAW FIRMS CONTRIBUTE LEGAL CITATIONS FOR GLOBAL RESEARCH CURATE LEGAL STAFF CURATES LEGAL CONTENT AND PUBLISHES TO GLOBAL RESEARCH DATABASE PUBLISH YOU REVIEW LEGAL CONTENT, AUTHOR AND PUBLISH RETENTION RULES AND PRIVACY OBLIGATIONS VIA THE ONLINE PORTAL Draft content Submit to Iron Mountain Monitor changes Embellish content Approve and publish Manage subscriptions Manage sources Publish retention rules and privacy obligations

9. SHOW CONNECTIONS VISUALLY THROUGH DATA FLOW MAPS CREATE A UNIFIED VIEW OF YOUR PERSONAL DATA AND RELATED OBLIGATIONS CONNECT CRITICAL INFORMATION ABOUT YOUR PERSONAL DATA

10. *Above are a summarized sampling of what data controllers and processors must do according to the full GDPR text. The full text can be found on the European Commission website: http :// ec.europa.eu /justice/data-protection/reform/files/ regulation_oj_en.pdf Keep a record of processing activities that involve personal data Document a lawful basis for processing data Only store data for as long as is necessary Notify authorities and data subjects about data breaches without undue delay Erase data under the 'right to be forgotten ’ Provide data subjects access to their data and processing details THE GDPR SAYS YOU MUST*: WITH POLICY CENTER YOU’LL HAVE: YOU’LL BE ABLE TO: Retention & Privacy Legal Citations Business Process Library & Data Flow Maps Show your record of processing activities on demand in a visual map Show connection of processing activities to retention and privacy requirements Know when personal data has met retention requirements so you can dispose of it Know if records containing personal data are in a data source that was breached Know where to locate personal data to comply with erasure requests Know when you can refuse erasure requests if retention requirements have not been met HOW POLICY CENTER CAN HELP YOU COMPLY WITH THE GDPR

11. Keep your retention and privacy policy management connected , current and compliant Save on information storage costs R educe unnecessary exposure to data breaches Reduce effort of responding to privacy requests Quickly locate personal information Reduce risk of fines Distribute policy to people and data repositories Join a collaborative user community WITH POLICY CENTER YOU’LL BE ABLE TO:

12. Join the Policy Center User Community to: Share ideas and best practices around Policy Center and other information governance topics Learn about Policy Center, trends in the industry, and how other companies are responding Advise on Policy Center feature development Build a strong community of passionate users and help us continue to build a solution that helps you JOIN THE POLICY CENTER USER COMMUNITY Collaborative community of information professionals, centered around the solution that helps you know your obligations and show compliance. SHARE LEARN ADVISE BUILD POLICY CENTER USER COMMUNITY

13. PRE-BUILT POLICY CENTER SOLUTION SUITE ESSENTIAL EDITION STANDARD EDITION Pre-built, best practice retention schedule for information created in general business departments Retention requirements updated annually Covers a single country (US, UK or Canada) Read-only retention schedule Available only to select small business customers as part of the Governance , Risk & Compliance service Includes Essential Edition features plus: Ability to personalize record classes and modify retention rules Option to add one industry-specific retention schedule * Click here for the latest list of pre-packaged industry standard retention schedules available.

14. CUSTOMIZED WITH ADVISORY SERVICES POLICY CENTER SOLUTION SUITE PROFESSIONAL EDITION ENTERPRISE EDITION Work with our expert Advisory Services team to customize your retention schedule Retention requirements continuously updated Covers multiple industries Option to connect policy to your content infrastructure through an open application programming interface (API) Coverage for up to 10 countries U p to 5 admins with editing capabilities Includes Professional Edition features plus: Work with Advisory Services on your privacy policy Privacy requirements continuously updated Data flow mapping tool to record processing activities (GDPR Article 30) Complete global coverage U p to 8 admins with editing capabilities

15. POLICY CENTER COMPETITIVE COMPARISON

16. 17 POLICY CENTER DIFFERENTIATION Working with Iron Mountain, customers benefit from our: INTEGRATED RETENTION AND PRIVACY POLICY MANAGEMENT Most providers either specialize in retention or privacy, but not both. Policy Center is a retention and privacy policy management platform that provides a unified view to keep your retention and privacy policy management connected, current and compliant. DEEP INFORMATION GOVERNANCE EXPERTISE Our Advisory Services team is one of the industry’s largest IG consultancies with expert professionals dedicated to the intricacies of retention, privacy, compliance and risk management for 20+ years. HIGH QUALITY, SPECIALIZED LEGAL RESEARCH Iron Mountain maintains relationships with an international network of law firms and legal research providers that are dedicated to the intricacies of retention and privacy legal research, rather than general legal research that you would find at most law firms.

17. 18 POLICY CENTER DIFFERENTIATION Working with Iron Mountain, customers benefit from our: FLEXIBLE, NEEDS-BASED PLATFORM Policy Center is a scalable platform available as a subscription service, ranging from pre-built to more advanced customized editions. Our Advisory Services team can work with you to customize and optimize your privacy policy and records classification scheme based on best practices, the level of granularity you need, and your risk appetite. COMPREHENSIVE INFORMATION MANAGEMENT PORTFOLIO Our breadth of services enable customers to deal with fewer vendors. Our broad multinational footprint and financial strength enable us to be where our customers need the solutions and services. INVESTMENT IN SECURITY AND INFRASTRUCTURE With dedicated security professionals focused on ensuring the security of your information, Iron Mountain is regularly named by Security Magazine in the Security 500 Survey, an annual ranking of the nation’s most secure companies.