技術的および運用上の対策
Last updated: 10 April 2024
Our safeguarding measures
Below is an overview of the technical and operational measures (‘TOMs’) that help safeguard our information assets, and those of our customers, against misuse, abuse or compromise. For additional security and privacy resources, please refer to our Trust Center.
- Encryption of data at rest and in transit: Personal data is encrypted using industry-standard protocols to protect it from unauthorised access during storage and transmission.
- Pseudonymization: Personal data transformed to prevent identification without additional information that is kept separate and secure.
- Access control: Only authorised personnel have access to personal data, based on the principle of least privilege.
- Multi-factor authentication (MFA): Employees are required to use more than one form of authentication to verify their identity, significantly reducing the risk of unauthorised access.
- Security audits and vulnerability assessments: Conducted periodically to identify and remediate potential security threats.
- Data backup and recovery: Robust data backup and disaster recovery procedures to ensure the availability and integrity of personal data in the event of a disaster or data loss incident.
- Network security: Firewalls, intrusion detection/prevention systems (IDPS), and other network security measures help protect against unauthorised access and cyber threats.
- Secure development practices: Secure coding guidelines, regular code reviews and security testing are part of the software development lifecycle.
- Data protection policies: Comprehensive data protection policies and procedures aligned with the EU/EEA GDPR are regularly socialised, reviewed and updated.
- Data processing agreements: Contracts with third parties who process personal data include clauses that require them to adhere to data protection standards and provisions equivalent to those agreed with the data controller.
- Employee training and awareness: Regular training sessions for employees on data protection best practices, security awareness, and the importance of protecting personal data are regularly conducted every quarter.
- Incident response plan: An incident response plan is in place to quickly and effectively respond to data breaches or security incidents.
- Data Protection Impact Assessments (DPIAs): As required by data protection regulation, DPIAs are conducted for processing activities that pose a high risk to the rights and freedoms of individuals. Data processing activities that do not meet the regulatory threshold are also subject to other types of risk assessments to ensure data protection principles and obligations have been sufficiently considered and addressed.
- Supplier and third-party management: Due diligence exercises are established to assess and monitor the data protection practices of suppliers and third parties that handle personal data.
- Compliance monitoring and reporting: Mechanisms established to monitor compliance with data protection laws and regulations, as well as reporting to relevant stakeholders and authorities as necessary.
