Do you perform, at minimum, annual reviews to your privacy and security policies?

Yes, privacy and security policies are reviewed once per year or upon impactful changes in our It / organisational architecture.