Technical and Organizational Measures

Technical and Organizational Measures

The Organisation implements and maintains appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, and other forms of unlawful or unauthorised processing. The measures are risk-based and proportionate to the nature, scope, context, and purposes of the processing, taking into account applicable legal, regulatory, contractual, and industry requirements.

1. Technical Measures

Data Security and Protection

• Personal data is protected through appropriate encryption and cryptographic controls during transmission and storage.
• Data validation controls are implemented to promote data accuracy, completeness, and integrity at the point of collection and processing.
• Personal data is protected from unauthorised alteration, loss, corruption, or disclosure through layered security controls and monitoring mechanisms.
• Data minimisation principles are incorporated into the design and operation of systems and processes where appropriate.

Access Management

• Access to systems and personal data is restricted to authorised individuals with a legitimate business need.
• Authentication and authorisation controls are implemented using unique user credentials and role-based access permissions.
• Privileged access is limited, monitored, and periodically reviewed.
• Password and authentication controls are implemented and maintained in accordance with established security standards.

Infrastructure and Network Security

• Network security controls are implemented to protect systems, applications, and data from unauthorised access and external threats.
• Segmentation and logical separation mechanisms are used, where appropriate, to restrict access between systems, environments, and user groups.
• Security monitoring capabilities are maintained to detect, investigate, and respond to suspicious or malicious activity.
• Anti-malware and endpoint protection measures are deployed and regularly updated.

Secure Hosting and Physical Security

• Systems processing personal data are hosted within secure facilities that employ appropriate physical, environmental, and operational security controls.
• Access to hosting environments is restricted to authorised personnel and subject to monitoring and control procedures.
• Infrastructure providers are required to maintain industry-recognised security standards and certifications where appropriate.

Backup, Recovery, and Resilience

• Backup procedures are implemented to support the availability and recovery of personal data and critical systems.
• Recovery processes are periodically tested to verify their effectiveness and ability to restore data and services following disruption or incident.
• Business continuity and disaster recovery capabilities are maintained to support operational resilience.

Security Testing and Vulnerability Management

• Security assessments are conducted on a regular basis to identify, assess, prioritise, and remediate vulnerabilities.
• Penetration testing, technical reviews, and other assurance activities are performed periodically based on risk and system criticality.
• Systems and applications are monitored and maintained through secure configuration, patch management, and change management practices.

Logging and Monitoring

• Appropriate logging, audit, and monitoring controls are maintained to support security event detection, incident investigation, and accountability.
• Access to audit records is restricted and protected against unauthorised alteration or deletion.

2. Organisational Measures

Governance and Accountability

• Information security and privacy management frameworks are maintained to support the protection of personal data and compliance with applicable requirements.
• Roles and responsibilities relating to privacy, security, and data protection are clearly defined and assigned.
• Policies, standards, procedures, and guidelines are maintained, reviewed, and updated on a regular basis.
• Appropriate governance arrangements are established and documented where processing activities involve multiple parties with shared, delegated, or allocated responsibilities relating to personal data processing.

Personnel Security and Confidentiality

• Personnel with access to personal data are subject to confidentiality obligations and are required to protect information in accordance with organisational policies.
• Background screening and onboarding controls may be applied where appropriate and permitted by law.
• Access rights are reviewed throughout employment and revoked promptly upon role changes or termination.

Training and Awareness

• Privacy, information security, and confidentiality training is provided to personnel at onboarding and on a recurring basis thereafter.
• Personnel receive role-appropriate guidance regarding the handling and protection of personal data.
• Security awareness initiatives are conducted to promote secure behaviours and reduce human error risks.

Operational Controls

• Operational processes include manual and automated oversight, review, and quality assurance activities designed to support data accuracy, data integrity, and the appropriate handling of personal data.
• Document control, records management, and change management processes are implemented to ensure controlled operation of systems, procedures, and documentation.
• These processes are supported by a quality management framework aligned with recognised quality standards, including ISO 13485 and ISO 9001.
• Significant changes to systems, services, or processing activities are subject to appropriate review and risk assessment.

Risk Management and Privacy by Design

• Privacy and security risks are assessed as part of the development, implementation, and operation of systems and services.
• Data protection and security considerations are incorporated into projects, products, and business processes through privacy-by-design and security-by-design principles.
• Risk assessments and, where appropriate, privacy impact assessments, data protection assessments, and governance reviews are conducted and periodically reviewed throughout the lifecycle of processing activities.

Supplier and Third-Party Management

• Third parties that process personal data are subject to appropriate due diligence and contractual controls before being granted access to personal data.
• Third-party security and privacy practices are periodically reviewed based on risk.
• Contractual requirements include confidentiality, security, incident notification, and data handling obligations as appropriate.

Incident and Breach Management

• Procedures are maintained to identify, assess, respond to, investigate, document, and remediate security incidents and personal data breaches.
• Incident response processes include defined escalation paths, responsibilities, communication procedures, and corrective actions.
• Lessons learned from incidents are used to improve security controls and organisational practices.

Compliance, Audit, and Continuous Improvement

• The effectiveness of technical and organisational measures is periodically reviewed, tested, and evaluated.
• Internal audits, management reviews, and other assurance activities are conducted to verify compliance with organisational requirements.
• Corrective and preventive actions are tracked and implemented to support continual improvement of the privacy and information security programme.

Information Security Management

• The Organisation maintains a certified Information Security Management System (ISMS) that establishes governance, risk management, operational security controls, and continual improvement processes for the protection of information assets.
• The information security management framework is aligned with recognised information security standards, including ISO 27001.

Certifications and Assurance

The Organisation maintains information security, quality, privacy, and risk management frameworks supported by independent certifications, assessments, audits, attestations, and assurance activities. Current certifications, attestations, and assurance documentation may be made available upon request, subject to confidentiality, security, and contractual requirements. Such certifications and attestations complement, but do not replace, the Organisation's ongoing responsibility to implement and maintain appropriate technical and organisational measures. The Organisation regularly evaluates and updates its controls to ensure they remain appropriate to the evolving threat landscape, operational environment, and applicable legal and regulatory requirements.