Data Protection & Privacy Guidelines

1. Purpose

This policy defines the rules and responsibilities for handling company, client, and employee data. It ensures data confidentiality, integrity, and compliance with legal and regulatory requirements.

2. Scope

This policy applies to all employees and interns.

3. Principles of Data Protection

Lawfulness, fairness, and transparency: Data must be processed legally and fairly.
Purpose limitation: Collect data only for specific, legitimate purposes.
Data minimization: Only collect necessary data.
Accuracy: Keep data accurate and up to date.
Storage limitation: Retain data only for as long as required.
Integrity and confidentiality: Protect data against unauthorized access, loss, or corruption.

4. Employee Responsibilities

Employees must:

Handle personal and company data responsibly.
Access data strictly for business purposes.
Avoid sharing sensitive data with unauthorized individuals.
Report any data breaches, loss, or suspicious activity immediately to IT.

5. Collection, Storage & Usage of Data

Collect only data required for business purposes.
Store data in company-approved systems or secure locations (P-Drive , OneDrive).
Avoid storing sensitive data on personal devices unless approved by IT.

6. Data Sharing & Transfer

Share data only with authorized personnel or third parties under confidentiality agreements.
Transfer data securely using company-approved methods (encrypted emails, Shared Folders , P-Drive).
Do not transfer sensitive data outside the company without prior approval.

7. Data Security Measures

Use strong passwords, multi-factor authentication (MFA), and secure access controls.
Keep devices, software, and applications updated with latest security patches.
Backup important data regularly using approved methods.
Secure physical storage of sensitive documents and restrict access to authorized personnel.

8. Breach Reporting

Immediately report any data breach, accidental disclosure, or loss to the IT team.
Cooperate with audits and investigations related to data breaches.

9. Monitoring & Compliance

The company may monitor data access and usage to ensure compliance.
Non-compliance may result in disciplinary action, restricted access, or termination.
Employees may be required to participate in periodic data protection training.

10. Policy Review

This policy will be reviewed annually and updated as needed to comply with legal requirements and best practices.

11. Acknowledgement

All employees must confirm that they have read, understood, and agree to comply with these Data Protection & Privacy Guidelines by signing the Data Protection Acknowledgement Form.