National Storage REIT : Incident and Breach Policy (NSFSL Incident and Breach Policy as of 8 August 2025)

National Storage Financial Services Limited Incident and Breach Policy

Adopted: 29 September 2021

Reviewed: 8 August 2025

Contents

Section 1 Overview 3

Section 2 Responsible persons and contact points 6

Section 3 Identification and Classification of incidents and breaches 7

Section 4 Escalating and Reporting Incidents 10

Section 5 Incident and Breach Register 13

Section 6 Policy Owner, Review and Version Control 14

Section 1 Overview

1. Purpose

   National Storage Financial Services Ltd (ACN 600 787 246) (National Storage) recognises that prompt identification and resolution of incidents and breaches is critical to ensure any material gaps and issues in its control environment are identified, escalated and rectified in a timely manner and in accordance with this Policy. As such, National Storage and the National Storage Group are committed to the timely management and remediation of all incidents and breaches and this Policy requires that all staff are to be aware of and escalate any suspected or actual breaches of internal policies and procedures, external rules and regulations, as well as any operational incidents.

   This Policy is also intended to assist in minimising client and reputation impacts and that we have addressed any internal and external disclosure requirements. By understanding and addressing the underlying cause of an incident or breach, this helps to minimise the potential for recurrence.

   National Storage is subject to legal and regulatory obligations in relation to incident and breach requirements. This includes the obligation to report certain breaches to regulators as required by law. It is a legal requirement that National Storage Financial Services Limited as a holder of an Australian Financial Services Licence (AFSL) (AFSL No. 475228) must establish and maintain compliance measures that ensure, as far as is reasonably practicable, the licencee complies with the provisions of the financial services laws at all times.

   The purpose of this Policy is to ensure that there is an appropriate and effective framework for the identification, management, escalation, resolution and reporting of incidents, breaches, and potential breaches.

2. Application

   This Incident and Breach Reporting Policy (Policy) covers the following:

   • National Storage Group employees;

   • National Storage Group directors; and

   • any other person acting on behalf of National Storage such as a contractor.

3. Related Policies

   Related Group policies include:

   • AML/CTF Program

   • Anti-Bribery and Corruption Policy

   • Client Complaints Handling Policy

   • Code of Conduct

   • Privacy Policy

   • Risk Management Policy

   • All Policies where there is a requirement to report breaches or incidents, as those breaches or incidents should be reported in accordance with this Policy.

4. Relevant Legislation / Regulation

   • Anti-Money Money Laundering and Counter Terrorism Financing Act 2006 (Cth)

   • ASIC Regulatory Guide 104: AFS licensing: Meeting the general obligations

   • ASIC Regulatory Guide 78: Breach reporting by AFS licencees and credit licencees

   • Corporations Act 2001 (Cth)

   • Privacy Act 1988 (Cth)

5. Definitions

Term	Definition
AFSL	Australian Financial Services Licence
AML/CTF	Anti-Money Laundering and Counter-Terrorism
ASIC	Australian Securities & Investments Commission
AUSTRAC	Australian Transaction Reports and Analysis Centre
Board	The board of directors of National Storage Financial Services Limited
CFO	Chief Financial Officer
CS	Company Secretary
Corporate Authorised Representa tive	A company appointed by an AFSL holder to be an authorised representative of that AFSL holder to provide financial services on its behalf and/or under its authority.
Corporations Act	Corporations Act 2001 (Cth)
GC	General Counsel
MD	Managing Director
National Storage or National Storage Group	National Storage Financial Services Limited (National Storage), AFSL No. 475228 (Licensee), as Responsible Entity for the following 2 named registered managed investment schemes: National Storage Property Trust (ARSN 101 227 712); and National Storage Active Investment trust (ARSN 609 004 837) Any corporate authorised representative of National Storage.

OAIC	Office of the Australian Information Commissioner
Related Body Corporate	Has the meaning given by section 50 of the Corporations Act being: a holding company of another body corporate; a subsidiary of another body corporate a subsidiary of a holding company of another body corporate. Applying this definition to joint ventures and/or partially owned companies can be a complex exercise. If there is any doubt as to whether a company is a Related Body Corporate, the issue should be escalated to the CS. Note that a conflict of interest may still be present even if the relevant company falls outside this definition