PERSONAL DATA AND INFORMATION SECURITY POLICY
The main theme of the ISO 27701 Personal Data Management System and the ISO 27001:2022 Information Security, Cybersecurity and Privacy Protection Management System, within the scope of Personal Data and Information Security Activities, is to demonstrate that information security management is ensured across people, infrastructure, software, hardware, company information, third-party information and financial resources; to secure risk management; to measure the performance of information security management processes; and to regulate relations with third parties on information security matters.
Accordingly, within the scope of our PDMS-ISMS Policy, we commit:
· To protect information assets against all threats, internal or external, intentional or unintentional; to ensure access to information as required by business processes; to meet legal requirements; and to work towards continuous improvement.
· To manage personal data and information assets, to determine the security values, needs and risks of assets, and to develop and implement controls against security risks.
· To ensure the continuity of the three core elements of the Personal Data and INFORMATION SECURITY, CYBERSECURITY AND PRIVACY PROTECTION MANAGEMENT SYSTEM in all activities.
Confidentiality: preventing unauthorised access to information and information assets,
Integrity: demonstrating that the accuracy and integrity of information are ensured,
Availability: demonstrating that authorised persons can access information when needed.
· To define the framework within which methods will identify personal data, information assets, their values, security needs and vulnerabilities, threats to assets and the frequency of those threats.
· To provide financial resources and personnel for risk treatment.
· To continuously monitor risks by reviewing technological expectations within the scope of the services provided.
· To comply with national and international regulations, laws and related legislation; to meet contractual obligations; and to fulfil information security requirements arising from corporate responsibilities towards internal and external stakeholders.
· To reduce the impact of information security threats on service continuity and to contribute to continuity.
· To prepare, maintain and test business continuity plans.
· To ensure continuous improvement.
· To continue working with environmental awareness and a sense of social responsibility to ensure environmental sustainability and address climate change.
We commit to continuing to fulfil the requirements of these activities.
