Purpose
The purpose of this policy is to define the organization’s commitment to protecting personal data and to establish a framework for the lawful and responsible processing of personal data.
Scope
This policy applies to all employees, contractors, processes, and systems within the organization that collect, process, store, or transmit personal data.
Policy Statement
The organization is committed to processing personal data lawfully, fairly, and transparently, and to respecting the privacy rights of individuals in accordance with applicable data protection legislation, including the GDPR.
Commitments
The organization shall:
- Process personal data only for specified, explicit, and legitimate purposes
- Limit data collection and retention to what is necessary
- Keep personal data accurate and protect it with appropriate technical and organizational measures
- Respect and respond to data subject rights in a timely manner
- Ensure compliance with applicable data protection laws and regulations
- Report and manage personal data breaches in accordance with legal requirements
- Provide training and awareness on data protection to personnel
Responsibilities
- Top Management is responsible for establishing, implementing, and maintaining this policy
- The Data Protection Officer (or designated role) is responsible for monitoring compliance and advising on data protection matters
- Employees are responsible for handling personal data in accordance with this policy and for reporting suspected breaches
Review
This policy shall be reviewed periodically to ensure its continuing suitability and alignment with organizational objectives.
