DATA POLICY
OF CLOUD4C

This Privacy Policy covers the life cycle of data protection and privacy aspects which includes data collection, treating, storing, maintaining, securing and disposing the data including PII (Personally Identifiable Information) which shall be from various channels. The purpose of this policy is to set out the relevant technical and organizational control measures where Cloud4C get complied with Industry best practices, regulatory and legal laws of the land. This policy applies to all the interested parties of the organization's information and privacy systems which includes employees, customers, suppliers, vendors and other third parties who have access to Cloud4C systems. Cloud4C complies with below Standards, Regulatory and Legal Requirements as per law of the land and supervisory authorities Regulatory and legal requirements, including:

• IT Act 2000,IT Ammendment 2008, IT Act rules 2011, DPDP Act 2023.
• GDPR, Contractual agreements, all other applicable laws.

The information security and privacy program is reviewed annually or upon significant changes to the information security and privacy environment.
Cloud4C has recognized that our business information and privacy is a critical asset and as such our ability to manage, control, and protect this asset will have a direct and significant impact on our future success.

The common terms used within this policy are defined by the ISO/IEC 29100 Privacy Framework international standard as follows:

PII principal
“Natural person to whom the personally identifiable information (PII) relates.”

Personally identifiable information (PII)

“Any information that
(a) can be used to identify the PII principal to whom such information relates, or
(b) is or might be directly or indirectly linked to a PII principal.”

Processing of PII
“Operation or set of operations performed upon personally identifiable information (PII)
Note 1 to entry: Examples of processing operations of PII include, but are not limited to, the collection, storage, alteration, retrieval, consultation, disclosure, anonymization, pseudonymization, dissemination or otherwise making available, deletion or destruction of PII of ”

PII Controller
“Privacy stakeholder(s) that determines the purposes and means for processing PII other than natural persons who use data for personal purposes.”

Joint PII Controller
PII controller that determine the purposes and means of the processing of PII jointly with one or more other PII controllers.

PII Processor
“Privacy stakeholder that processes personally identifiable information (PII) on behalf of and in accordance with the instructions of a PII controller.”

“Customer Configuration” means an information technology system (hardware, software and/or other information technology components) which is the subject of the Services or to which the Services relate.

“Customer Data" means all data which Customer receives, stores, or transmits on or using the Customer Configuration.

Derived Data means data or information, created, generated from use of customer data or configuration.

Direct Data classifies items such as name, address, birthplace, marital status and occupation.

Cloud service provider - party which makes cloud services available according to the cloud model.

Processing of PII Operation or set of operations performed on personally identifiable information (PII).

Sub-processor" means any Data Processor (including any third party) appointed by the Processor to process Controller Personal Data on behalf of the Controller.

Privacy Breach
Situation where personally identifiable information is processed in violation of one or more relevant
privacy safeguarding requirements.

Privacy Controls
Measures that treat privacy risks by reducing their likelihood or their consequences.

Privacy Enhancing Technology -PET
Privacy control, consisting of information and communication technology (ICT) measures, products,
or services that protect privacy by eliminating or reducing personally identifiable information (PII) or
by preventing unnecessary and/or undesired processing of PII, all without losing the functionality of
the ICT system.

Privacy Policy
Overall intention and direction, rules and commitment, as formally expressed by the personally
identifiable information (PII) controller related to the processing of PII in a particular setting.

Privacy Preferences
Specific choices made by a personally identifiable information (PII) principal about how their PII
should be processed for a particular purpose.

Privacy Principles
Set of shared values governing the privacy protection of personally identifiable information (PII) when processed in information and communication technology systems.

Privacy Risk
Effect of uncertainty on privacy.

Privacy Risk Assessment
Overall process of risk identification, risk analysis and risk evaluation with regard to the processing of personally identifiable information (PII).
This process is also known as a privacy impact assessment.

Privacy Safeguarding Requirements
Set of requirements an organization has to take into account when processing personally identifiableinformation (PII) with respect to the privacy protection of PII.

Privacy Stakeholder(s)
Natural or legal person, public authority, agency or any other body that can affect, be affected by, or
perceive themselves to be affected by a decision or activity related to personally identifiable
information (PII) processing.

Pseudonymization
Process applied to personally identifiable information (PII) which replaces identifying information with an alias.

Secondary Use
Processing of personally identifiable information (PII) in conditions which differ from the initial ones.

Sensitive PII
Category of personally identifiable information (PII), either whose nature is sensitive, such as those
that relate to the PII principal's most intimate sphere, or that might have a significant impact on the PII principal.

Third Party
Privacy stakeholder other than the personally identifiable information (PII) principal, the PII controller and the PII processor, and the natural persons who are authorized to process the data under the direct authority of the PII controller or the PII processor.
 

The objective of this policy is to make sure that the provisioning of a service is in accordance with the business, security and Privacy requirements with reference to the applicable o laws and regulations.

• protect the Cloud4C information assets through safeguarding its confidentiality, integrity, availability and Privacy.
• establish effective governance arrangements including accountability and responsibility for information security and privacy within Cloud4C.
• maintain an appropriate level of Customer, Vendor, Supplier, Employees and other stakeholders awareness, knowledge and skill to minimize the occurrence and severity of information security and privacy incidents.
• Ensure Cloud4C is able to continue and/or rapidly recover its business operations in the event of a detrimental information security and privacy incident.
• Cloud4C is committed to protect information and privacy. This Policy deals with the security and privacy requirements at the level of design / life cycle which includes, collection, storing, maintaining, disclosing, securing and disposing of personal identifiable information as per privacy policy.
• Clou4C proactively addresses data principal's expectations concerning their privacy and security in order to create and ensure trust and confidence in Cloud4C and its services provided.
• Compliance with relevant privacy and data protection laws is maintained thereby minimizing legal liability, regulatory risk, brand and reputational exposure; and
• A data principal's PII is collected after acquiring consent and processed in fair and transparent manner and in compliance with applicable laws and regulations. Cloud4C is committed to maintaining and improving data protection and privacy within the company and minimizing its exposure to risks.

3.1.THE PERSONAL DATA THAT WE COLLECT FROM THE USER:

Cloud4C collects information during User's interactions with Cloud4C, whether through business related interactions or online (involuntary), including through Cloud4C's websites that is necessary to conduct its business, to provide the services to the customers, as part of business operations and optimization of its service offerings.
Cloud4C may collect, use, store and transfer different kinds of personal data which have been grouped together as follows:

• Identity Data: including first name, last name.
• Contact Data: including address, email address, and telephone numbers.
• Marketing and Communications Data: including User's preferences in receiving marketing from Cloud4C (including authorized third parties) and User's communication preferences.
• Public PII is easily accessible from public sources like phonebooks, the Internet, and corporate directories Visiting Cards, Business telephone number and Business mailing or email address.

3.2.HOW IS YOUR PERSONAL DATA COLLECTED AND USED?

Generally, Cloud4C collects personal information related to customers and their representatives when they decide to interact with us, or avail services or express an interest or apply for a position, Employees, Visitors, vendors, contractors, subcontractors and other third party. The kind of data that Cloud4C collects and/or has visibility/access to, depends solely on the context and the nature of User's interaction with Cloud4C and in case of Cloud4C's customers, the nature service offering that such customer avails from Cloud4C. Cloud4C do not solicit and/or collect any sort of personal information that is irrelevant/not necessary for the provision of services to the User. Cloud4C further declare that it does not participate in any sort of data mining activities whatsoever, with any third parties.

Cloud4C uses Customer PII only to the extent such data is required to provide the services agreed upon, and does not mine it for marketing or advertising. In case a Customer decides to suspend the services or terminates the requirement for availing services, Cloud4C shall, in accordance with Customer's requirements, and any applicable laws policies it has, follows strict standards and requisite processes for deleting Customer PII from its servers.

If anyone represents an organization, such as business or individual, that utilizes Enterprise services from Cloud4C, please see Cloud4C privacy statement to learn how we process data.

Customer or Individual have choices when it comes to the technology used and the data shared. When Cloud4C asks to provide personal data, Customer or Individual can decline. Many of our services require personal data to provide with a service. If Customer or Individual choose not to provide data required to provide with a service or feature, Customer or Individual cannot use that service or feature. Likewise, where Cloud4c needs to collect personal data by law or to enter into or carry out a contract with Customer or Individual, and they do not provide the data, Cloud4C will not be able to enter into the contract; or if this relates to an existing service being used, Cloud4C may have to suspend or cancel it. We will notify Customer or Individual if this is the case at the time. Where providing the data is optional, and Customer or Individual choose not to share personal data, features like personalization that use such data will not work for them.

Cloud4C undertakes that Cloud4C uses personal data strictly in compliance with applicable laws.
Purposes for which Cloud4C may collect the personal data belonging to the User and the rationale behind such collection:

Cloud4C uses personal information only where required for specific purposes. The following table serves as an explainer for the purpose for which Cloud4C collects/uses of the personal data belonging to the User and the rationale behind such collection/use:

 

• Where the above table states that we rely on our legitimate interests for a given purpose, we are of the opinion that our legitimate interests are not overridden by your interests, rights or freedoms, given (i) the transparency we provide on the processing activity.
• In carrying out these purposes, Cloud4C combines data collects from different contexts (from the use of two different services of Cloud4C ) or obtain from third parties to give you a more seamless, consistent, and personalized experience, to make informed business decisions, and for other legitimate purposes.
   

3.3.DATA MINIMISATION

• Cloud4C shall ensure that personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

3.4.HOW WE SHARE / DISCLOSE YOUR PERSONAL DATA

Purposes for which Cloud4C may share personal data belonging to the User:
Cloud4C shares / disclose the User's personal data with the User's consent and/or to carry out any transaction and/or provide any service that the User has authorized or requested. Cloud4C also shares/ disclose any such personal data with its wholly owned subsidiaries and affiliates whenever necessary, to optimize Cloud4C's service offerings.

Further, Cloud4C may also share / disclose User's personal data with its vendors/suppliers/third parties when customer or user separately consent to or request such sharing on strict need to know basis, ensuring that such parties are bound by the privacy principles detailed herein and are bound by strict confidentiality obligations.

Lastly, Coud4C shares / disclose the personal data when required by applicable laws/legal mandates and/or in order to respond to any legal process, including but not limited to protection of the rights and property of Cloud4C and its customers.

3.5. IN RESPONSE TO THE LAW.

Cloud4C may disclose Customer's information if it required to comply with a law, regulation, or valid legal process. If Cloud4C is going to disclose Customer's information, Cloud4C will provide Customer with a notice unless it is prohibited from doing so under law or under judicial or executive order. Further, Cloud4C may disclose Customer's information without providing customer with a prior notice if it reasonably be required that such disclosure is necessary to prevent imminent and serious harm to a person.

3.6.TO PROVIDE SERVICES AND TO FIX ISSUES.

Cloud4C will provide services as per agreed terms under contract to provide Cloud or other services. This may include applying new product or system versions, patches, updates and upgrades; monitoring and system use and performance; and other issues reported to Cloud4C.
Based on the request raised by the customer, Cloud4C accesses customer setup to resolve particular issue. Cloud4C will use temporary access to fix the issue raised by the Customer within agreed time window.
Cloud4C may share customer personal information with its wholly owned subsidiaries and affiliates whenever necessary, to optimize Cloud4C's service offerings. These includes other companies within the Cloud4C Services Pvt Ltd. such as CtrlS,…etc.

Individual PII We may share personal data with one or all of the following:

• Internal Third Parties: these include other companies within the Cloud4C Services Pvt Ltd. such as CtrlS,…etc.

External Third Parties may include:

• Suppliers / Business Partners who we engage to provide services on our behalf, for example payment processors and marketing services companies.
• Authorities who require reporting of processing activities in certain circumstances.

3.7.VENDOR HAVING ACCESS TO PII?

• Service or work involving vendor access to PII include:
  A contractor is hired to provide payroll service to assist organization Performance Management system. The potential exists for the contractor to have access to PII of employee such as names, mailing addresses, salary slip, personal telephone numbers, and financial account information.
• A vendor or contractor is hired to perform survey on the organization work culture or corporate program to be used by Organization Top Management. Depending on the nature of the survey, the vendor or contractor may have access to PII such as names of the survey respondents, email addresses, etc.
• A contractor is hired to deploy or upgrade physical access control systems (e.g., card swipe entry readers) and Biometric access card. The potential exists for the contractor to have access to any PII collected via the card swipe and thumb impression such as names, Organization ID numbers and finger print.

3.8.STORING YOUR PERSONAL INFORMATION

How long we hold personal information will vary and will depend principally on:

• the purpose for which we are using personal information - we will need to keep the information for as long as is necessary for the relevant purpose, and
• Legal obligations - laws or regulation may set a minimum period for which we have to keep personal information.
• We will ensure that the personal information that we hold is subject to appropriate security measures.
• Access to personal information is limited to personnel who need access and appropriate security should be in place to avoid unauthorized sharing of information.
• When personal data is deleted this should be done safely such that the data is irrecoverable.
• Appropriate back-up and disaster recovery solutions shall be in place.

3.8.1.ARCHIVING / REMOVAL

To ensure that personal data is kept for no longer than necessary as per data classification and applicable law, the Cloud4C implements retention period for each area in which personal data is processed and review this process annually.
The retention period shall consider what data should/must be retained, for how long, and why.

3.9.LAWFULNESS OF PROCESSING

Depending on the legislation involved, there may be a number of alternative ways in which the lawfulness of a specific case of processing of PII may be established. It is Cloud4C policy to identify the appropriate basis for processing and to document it, in accordance with the applicable legislation. The main options are described in brief in the following sections.

3.10.CONSENT

Where appropriate, will obtain consent from a PII principal to collect and process their data. In case of children below the age specified in applicable legislation parental consent will be obtained. Transparent information about our usage of their PII will be provided to PII principals at the time that consent is obtained and their rights regarding their data explained, such as the right to withdraw consent. This information will be provided in an accessible form, written in clear language and free of charge.
If the PII is not obtained directly from the PII principal, then this information will be provided to the PII principal within a reasonable period after the data is obtained and definitely within one month.

3.11.PERFORMANCE OF A CONTRACT

Where the PII collected and processed is required to fulfil a contract with the PII principal, consent is not required. This will often be the case where the contract cannot be completed without the PII in question, for example, a delivery cannot be made without an address.

3.12.LEGAL OBLIGATION

If the PII is required to be collected and processed in order to comply with applicable law, then consent is not required. This may be the case for some data related to employment and taxation for example, and for many areas addressed by the public sector.

3.13.VITAL INTERESTS OF THE PII PRINCIPAL

In a case where the PII is required to protect the vital interests of the PII principal or of another natural person, then this may be used as the lawful basis of the processing. Cloud4C will retain reasonable, documented evidence that this is the case, whenever this reason is used as the lawful basis of the processing of PII. As an example, this may be used in aspects of social care, particularly in the public sector.

3.14.RIGHTS OF THE PII PRINCIPAL/ INDIVIDUAL/ DATA SUBJECTS

The PII principal also has rights with regard to their PII. These will generally consist of:

1.The right to be informed.
2.The right of access.
3.The right to rectification.
4.The right to erasure.
5.The right to restrict processing.
6.The right to data portability.
7.The right to object.
8.Rights in relation to automated decision making and profiling.

Each of these rights are supported by appropriate procedures within Cloud4C that allow the required action to be taken within the timescales stated in the applicable privacy legislation.
These rights include:

• Obtaining information regarding the processing of personal information and access to the personal information which we hold.
• Please note that there may be circumstances in which we are entitled to refuse requests for access to copies of personal information. In particular, information that is subject to legal professional privilege will not be disclosed other than to our member and as authorized by our member.
• Requesting that we correct personal information if it is inaccurate or incomplete.
• Requesting that we erase personal information in certain circumstances. Please note that there may be circumstances where we erase personal information but we are legally entitled to retain it.
• Objecting to, and requesting that we restrict, our processing of personal information in certain circumstances. Again, there may be circumstances where you object to, or ask us to restrict, our processing of personal information but we are legally entitled to refuse that request.
• Withdrawing your consent, although in certain circumstances it may be lawful for us to continue
  processing without your consent if we have another legitimate reason (other than consent) for doing so.
  Cloud4C applied appropriate data management data management practice to govern the processing of personnel data. Cloud4C limits the disclosure of personal to authorized persons.

3.15.TASK CARRIED OUT IN THE PUBLIC INTEREST (LAW ENFORCEMENT AGENCIES)

Where Cloud4C needs to perform a task that it believes is in the public interest or as part of an official duty then the PII principal's consent will not be requested. The assessment of the public interest or official duty will be documented and made available as evidence where required.

3.16.LEGITIMATE INTERESTS

If the processing of specific PII is in the legitimate interests of Cloud4C and is judged not to affect the rights and freedoms of the PII principal in a significant way, then this may be defined as the lawful reason for the processing. Again, the reasoning behind this view will be documented.

3.17.PRIVACY BY DESIGN

Cloud4C has adopted the principle of privacy by design and will ensure that the definition and planning of all new or significantly changed systems that collect, or process PII will be subject to due consideration of privacy issues, including the completion of one or more privacy impact assessments.

The privacy impact assessment will include:

• Consideration of how PII will be processed and for what purposes.
• Assessment of whether the proposed processing of PII is both necessary and proportionate to the purpose(s).
• Assessment of the risks to individuals in processing the PII.
• What controls are necessary to address the identified risks and demonstrate compliance with applicable legislation.

Use of techniques such as data minimization and pseudonymisation will be considered where applicable and appropriate, including at the end of processing, and the mechanisms used to achieve them will be documented.

Personally Identifiable Information (PII) – any information that, by means of use or correlation with other data or information, can be used to uniquely identify an entity. The PII has been categorized by Cloud4C into three types 1. Sensitive PII 2. Highly Sensitive PII 3. Non- Sensitive or Public PII.

4.1.SENSITIVE PII

Sensitive Personal Identifying Information (PII) is defined as information that if lost, compromised, or disclosed could result in substantial harm, inconvenience, or unfairness to an individual.
Sensitive PII include:

• Bank account numbers
• Passport information
• Driver's license
• Address
• Employees Dependents Data

4.2.HIGHLY SENSITIVE PII:

• Healthcare related information
• Medical insurance information
• Biometric data: Finger print or voice signatures
• Social security number
• Children's Data (Below 16 Yrs.)
• Government issued IDs
• Social Security Number
• Driver's License Number
• Passport Number
• Personal Banking, Debit, or Credit Card Account Information
  
  Non-sensitive or Public PII is easily accessible from public sources like phonebooks, the Internet, and corporate directories.

4.3.NON-SENSITIVE OR PUBLIC PII:

• Visiting Cards
• Business telephone number
• Business mailing or email address
• The above list contains pieces of information and examples of non-sensitive information that can be released to the public. This type of information cannot be used alone to determine an individual's identity.

However, non-sensitive information, although not delicate, is linkable. This means that non-sensitive data, when used with other personal linkable information, can reveal the identity of an individual.
Cloud4C will ensure that all relationships it enters that involve the processing of PII are subject to a documented contract that includes the specific information and terms required by the applicable legislation, Data Processing Agreement.

4.4.INTERNATIONAL TRANSFERS OF PII

Transfers of PII between countries will be carefully reviewed prior to the transfer taking place to ensure that they fall within the limits imposed by the applicable legislation. This depends partly on the relevant authority's judgement (for example in the case of the GDPR, the European Commission) as to the adequacy of the safeguards for PII applicable in the receiving country and this may change over time.

Where an adequacy decision (or similar statement) does not exist for a destination country, an appropriate safeguard such as standard contractual clauses will be used, or a relevant exception identified as permitted under the applicable legislation.

4.5.DATA PROTECTION OFFICER

A defined role of Data Protection Officer (DPO) is generally required under privacy legislation if an organization is a public authority, if it performs large scale monitoring or if it processes particularly sensitive types of data on a large scale. The DPO is required to have an appropriate level of knowledge and can either be an in-house resource or outsourced to an appropriate service provider.
Based on these criteria, Cloud4C has appointed the Data Protection Officer.

4.6.BREACH NOTIFICATION

It is policy to be fair and proportionate when considering the actions to be taken to inform affected parties regarding breaches of PII. In line with the applicable legislation, where a breach is known to have occurred which is likely to result in a risk to the rights and freedoms of individuals, where required the relevant supervisory authority will be informed within the specified timeframe (for example, for the GDPR within 72 hours, as per new DPDP Act 2023 of India (As it stands today, a data breach is a cyber incident that must be reported to the India Computer Emergency Response Team (CERT-In) within 6 hours of first knowledge about the breach)). This will be managed in accordance with our Information Security and privacy Incident Response Procedure which sets out the overall process of handling information security and privacy incidents.

Under privacy legislation (Law of the land) the relevant authority DP may have the right to impose a range of fines, often based on a percentage of annual worldwide turnover or a specific amount, for infringements of the regulations.

4.7.ADDRESSING COMPLIANCE TO APPLICABLE PRIVACY LEGISLATION

The following actions are undertaken to ensure that Cloud4C complies at all times with the accountability principle of privacy legislation within the countries in which it operates:

• The legal basis for processing PII is clear and unambiguous
• A Data Protection Officer is appointed with specific responsibility for data protection in the organization (if required)
• All staff involved in handling PII understand their responsibilities for following good data protection practice
• Training in data protection has been provided to all staff
• Rules regarding consent are followed
• Routes are available to PII principals wishing to exercise their rights regarding PII and such enquiries are handled effectively
• Regular reviews of procedures involving PII are carried out
• Privacy by design is adopted for all new or changed systems and processes
• The following documentation of processing activities is recorded:
  
  • Organization name and relevant details
  • Purposes of the PII processing
  • Categories of individuals and PII processed
  • Categories of PII recipients
  • Agreements and mechanisms for transfers of PII to other countries including details of controls in place
  • PII retention schedules
  • Relevant technical and organizational controls in place

These actions are reviewed on a regular basis as part of the management process concerned with privacy and data protection.
 

Organizations that collect, process or use personal data themselves or on behalf of others must take the technical and organizational measures necessary to ensure compliance with the provisions of the data protection laws. The measures must be suitable to adequately protect the personal data according to their nature and category. The measures are only necessary if their effort is in a reasonable relation to the intended protection purpose.

• Organizational management and dedicated staff responsible for the development, implementation, and maintenance of Cloud4C's information security program.
• Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to the Cloud4C organization, monitoring and maintaining compliance with Cloud4C policies and procedures, and reporting the condition of its information security and compliance to senior internal management.
• Maintain Information security policies and make sure that policies and measures are regularly reviewed and where necessary, improve them.
• Communication with Cloud4C applications utilizes cryptographic protocols such as TLS to protect information in transit over public networks. At the network edge, stateful firewalls, web application firewalls, and DDoS protection are used to filter attacks. Within the internal network, applications follow a multi-tiered model which provides the ability to apply security controls between each layer.
• Data security controls which include logical segregation of data, restricted (e.g. role-based) access and monitoring, and where applicable, utilization of commercially available and industry-standard encryption technologies.
• Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions, (e.g. granting access on a need-to-know and least privilege basis, use of unique IDs and passwords for all users, periodic review and revoking/changing access promptly when employment terminates or changes in job functions occur).
• Password controls designed to manage and control password strength, and usage including prohibiting users from sharing passwords.
• System audit or event logging and related monitoring procedures to proactively record user access and system activity for routine review.
• Physical and environmental security of data center, server room facilities and other areas containing client confidential information designed to: (i) protect information assets from unauthorized physical access, (ii) manage, monitor and log movement of persons into and out of Cloud4C facilities, and (iii) guard against environmental hazards such as heat, fire and water damage.
• Operational procedures and controls to provide for configuration, monitoring, and maintenance of technology and information systems according to prescribed internal and adopted industry standards, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from Cloud4C possession.
• Change management procedures and tracking mechanisms to designed to test, approve and monitor all changes to Cloud4C technology and information assets.
• Incident / problem management procedures designed to allow to Cloud4C investigate, respond to, mitigate and notify of events related to Cloud4C technology and information assets.
• Network security controls that provide for the use of enterprise firewalls and layered DMZ architectures, and intrusion detection systems and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack.
• Vulnerability assessment, patch management, and threat protection technologies and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code.
• Business resiliency/continuity and disaster recovery procedures, as appropriate, designed to maintain service and/or recovery from foreseeable emergency situations or disasters.
• Formal Vendor Management program, including vendor security reviews for critical vendors to ensure compliance with Cloud4C Information Security Policies.
• A Data Protection Officer (DPO) who is independent, regularly reviews data protection risks and controls.