Protection of Personal Information Policy

Introduction

This policy aims to guide The National Debt Review Center Pty Ltd in managing personal information as set out in the Privacy Policy and Information Security Policy.

Scope

This policy applies to:

• All our information, whether electronic or otherwise, in any location;
• All information systems and applications; and
• Employees, contractors, and other individuals who have access to our information.

You must be familiar with this policy and comply with its terms. We may supplement or amend this policy with additional policies and guidelines from time to time.

Purpose

The purpose of this policy is to direct all employees of The National Debt Review Center Pty Ltd in the acceptable use and security of the business's IT system and infrastructure. These standards contain directions for employees, indicating both acceptable and unacceptable internet use to control employee behaviour and actions that contribute to the business's internet risks while maximising the benefits gained by The National Debt Review Center Pty Ltd through internet usage. As the software, hardware, and computer network is the property of The National Debt Review Center Pty Ltd, we reserve the right to keep our systems secure through monitoring electronic information and regular checks on the system.

Roles and Responsibilities

• The National Debt Review Center Pty Ltd management will establish a periodic reporting requirement to measure the compliance and effectiveness of this policy.
• The National Debt Review Center Pty Ltd management is responsible for implementing the requirements of this policy or documenting non-compliance.
• All of the business's employees are required to read and acknowledge this policy.

Policy Directives

Enforcement, Auditing, Reporting

1. Introduction

This policy aims to guide The National Debt Review Center Pty Ltd in managing personal information.

2. Purpose

This policy establishes the guidelines for managing user access to information of the business. The purpose is to ensure the necessary user access controls are in place for controlling the actions, functions, applications and operations of legitimate users. The aim is to protect the confidentiality, integrity, and availability of all the business's information resources.

All managers of the business's information resources will ensure that access to the business's information is properly authorised and granted with correct access levels and privileges applied.

3. Scope

This policy applies to all information resources, systems, and technology and to all users of these resources, systems and technology within the business's operating environment or connected to the business's information infrastructure.

4. Operational Definitions

5. Access Control Measures

6. Roles and Responsibilities

• The National Debt Review Center Pty Ltd management will establish a periodic reporting requirement to measure the compliance and effectiveness of this policy;
• The National Debt Review Center Pty Ltd management is responsible for implementing the requirements of this policy or documenting non-compliance;
• The Information Officer and/or Deputy Information Officer(s), are required to train employees on the policy and document issues with policy compliance;
• All of the business's employees are required to read and acknowledge this policy by signing it;
• The Information Officer has primary management responsibility for administering user access to the business's information resources.

7. Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals may be subject to loss of the business's information resources access privileges and/or further civil and criminal prosecution.

Introduction

This policy aims to guide The National Debt Review Center Pty Ltd in managing all aspects related to the Anti-Virus's use and procedures within the business.

Purpose

The purpose of this policy is to establish minimum anti-virus requirements which must be met by all computers connected to the business's networks and to ensure effective virus detection and prevention.

Scope

This policy applies to all of the business's computers that are Macs, PC-based or utilise PC-file directory sharing. This includes, but is not limited to, desktop computers, laptop computers, file/ftp/tftp/proxy servers.

Roles and Responsibilities

Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals are subject to loss of the business's information resources access privileges, civil, and criminal prosecution.

Introduction

This policy aims to guide The National Debt Review Center Pty Ltd to establish minimum requirements to ensure information is not left unattended at your workstation.

Scope

This policy applies to all The National Debt Review Center Pty Ltd employees and affiliates contractors, and other individuals who have access to any information systems and/or records containing personal information processed by The National Debt Review Center Pty Ltd.

Purpose

The purpose of this policy is to establish the minimum requirements for maintaining a "clean desk" – where all personal information is used.

Policy Requirements

• Employees are required to ensure that all information in hardcopy or electronic form is secure in their work area at the end of the day and when they are expected to be gone for an extended period.
• Computer workstations must be locked when workspace is unoccupied.
• Computer workstations must be shut down completely at the end of the workday.
• Any personal information must be removed from the desk and locked in a drawer when the desk is unoccupied, and at the end of the workday.
• File cabinets containing personal information must be kept closed and locked when not in use or when not attended.
• Keys used for access to personal information must not be left unattended.
• Laptops must be either locked with a locking cable or locked away in a drawer or office.
• Passwords may not be left on sticky notes posted on or under a computer, nor may they be left written down in an accessible location.
• Printouts containing personal information should be immediately removed from the printer.
• Upon disposal, documents containing personal information should be shredded in the official shredder bins or placed in the lock confidential disposal bins.
• Whiteboards containing restricted and/or sensitive information should be erased.
• Employees must treat mass storage devices such as CDROM, DVD or USB drives as sensitive, and secure them in a locked drawer.
• All printers and fax machines should be cleared of papers as soon as they are printed; this helps ensure that sensitive documents are not left in printer trays for the wrong person to pick up.

Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals may be subject to loss of the business's information resources access privileges and/or further civil and criminal prosecution.

Introduction

This policy aims to guide The National Debt Review Center Pty Ltd in managing all aspects related to data retention and procedures within the business.

Scope

This policy applies to all documents which are collected, processed, or stored by the business and includes but is not limited to documents in hardcopy and electronic format, for example, email, web and text files, PDF documents etc.

Purpose

The purpose of this policy is to ensure that necessary records and documents of the business are adequately protected and maintained to ensure that records are not retained for longer than necessary. This policy is also for the purpose of aiding employees of the business in understanding their obligations in retaining documents.

Guidelines for the Retention of Documents

• The business may suspend the destruction of any record or document due to pending or reasonably foreseeable litigation, audits, government investigations or similar proceedings. Employees will be notified of applicable documents to which they have access where the destruction has been suspended.
• All documentation and personal information that is being stored by the business in accordance with this policy must be stored and guarded in compliance with all the business's policies.
• The documentation and information listed below may not contain all the records and documents processed and in the possession of the business and should merely be used as a guideline.
• In the event that a document and/or information is no longer required to be stored in accordance with this policy and relevant legislation, it should be deleted and destroyed in accordance with the Data Destruction Policy of the business.
• The Information Officer should be consulted where there is uncertainty regarding the retention and destruction of a document and/or information.

Retention Schedules

Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals may be subject to loss of the business's information resources access privileges and/or further civil and criminal prosecution.

1. Introduction

This policy aims to guide The National Debt Review Center Pty Ltd in managing personal information. This policy and procedures are a supplement to The National Debt Review Center Pty Ltd's Information Security Policy.

2. Scope

This policy applies to:

• all our information, whether electronic or otherwise, in any location;
• all information systems and applications; and
• employees, contractors, and other individuals who have access to our information.

You must be familiar with this policy and comply with its terms. We may supplement or amend this policy with additional policies and guidelines from time to time.

3. Purpose

The business provides employees with electronic communication tools, including an email system. This email policy, which governs employee use of the business email system, applies to email use at the business's premises, as well as remote locations, including, but not limited to employee homes, airports, hotels and client and supplier offices. The business's email rules and policies apply to full-time employees, part-time employees, independent contractors, interns, consultants, suppliers, clients, and other third parties. Any employee who violates the business's email rules and policies is subject to disciplinary action, up to and including termination.

4. Email exists for business purposes

The business allows email access primarily for business purposes and employees may not use the email system for any personal use.

5. Email monitoring activities

The business reserves the right to monitor, inspect, copy, review, and store any and all employee's email use at any time and without prior notice. In addition, the business may monitor, inspect, copy, review, and store any files, information, software, and other content created, sent, received, downloaded, uploaded, accessed, or stored through the business's email system. The business reserves the right to disclose e-mail information and images to regulators, courts, law enforcement agencies and other third parties without the employee's consent.

6. Offensive content and harassing or discriminatory activities are banned

Employees are prohibited from using e-mail to engage in activities or transmit content that is harassing, discriminatory, menacing, threatening, obscene, defamatory, or in any way objectionable or offensive.

7. Employees are prohibited from using email to

• Send, receive, solicit, print, copy, or reply to text, images, or jokes that disparage others based on their race, religion, colour, gender, sex, sexual orientation, national origin, veteran status, disability, ancestry, or age.
• Send, receive, solicit, print, copy or reply to messages that are disparaging or defamatory.
• Spread gossip, rumours, or innuendos about employees, clients, suppliers, or other outside parties.
• Send, receive, solicit, print, copy or reply to sexually orient messages or images.
• Send, receive, solicit, print, copy or reply to messages or images that contain foul, obscene, disrespectful, or adult-oriented language.
• Send, receive, solicit, print, copy or reply to messages or images that are intended to alarm others, embarrass the business, negatively impact employee productivity, or harm employee morale.

8. Confidential, proprietary, and personal information must be protected

Unless authorised to do so, employees are prohibited from using email to transmit confidential information to outside parties. Employees may not access, send, receive, solicit, print, copy or reply to confidential or proprietary information about the business, its employees, clients, suppliers, and other business associates unless there is a legitimate reason to do so. Confidential information includes, but is not limited to, client lists, credit card numbers, identification numbers, employee performance reviews, salary details, trade secrets, passwords and information that could embarrass the business and its employees if the information were disclosed to the public.

9. Information exchange and internet transactions

• All messages communicated on the business's internet and email system must contain the employee's name, surname, title, and contact details. No email or any other electronic communication may be sent which hides the identity of the sender or represents the sender as someone else. All emails sent must include the email signature of the sender.
• The disclaimer as prescribed by The National Debt Review Center Pty Ltd management must be used at the end of all email messages.

10. Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals may be subject to loss of the business's information resources access privileges and/or further civil and criminal prosecution.

Any employee must, at any time, report policy violations to The National Debt Review Center Pty Ltd management which report will be reported as confidential and may be done anonymously.

1. Introduction

This policy aims to guide The National Debt Review Center Pty Ltd in managing the confidentiality and integrity of personal information processed by The National Debt Review Center Pty Ltd by governing the use handheld and mobile devices.

2. Scope of application and obligations

3. Purpose

This policy establishes rules for the proper use of handheld and mobile devices in the business in order to protect the confidentiality of sensitive data, the integrity of data and applications and the availability of services at the business, protecting both handheld devices and their users, as well as corporate assets (confidentiality and integrity) and continuity of the business.

4. Roles and responsibilities

• The National Debt Review Center Pty Ltd management must ensure that all employees using devices falling into the category of "handheld devices" have acknowledged this security policy and the associated procedures before they are allowed to use corporate services using handheld devices.
• The National Debt Review Center Pty Ltd management must ensure that handheld devices and their users comply with this security policy and all security policies as stipulated by the business.
• In a general sense, all users are required to use their common sense in order to act in the best interest of the business, its assets and its services.
• In case of doubt, users must contact The National Debt Review Center Pty Ltd management to clarify a given situation.
• Users of handheld devices must diligently protect such devices from loss and disclosure of private information belonging to or maintained by the business.
• Before connecting a mobile handheld device to the network at the business, users must ensure it is on the list of approved devices issued by The National Debt Review Center Pty Ltd management.
• The National Debt Review Center Pty Ltd management must be notified immediately upon suspicion of a security incident, especially when a mobile device may have been lost or stolen.
• The cost of any item beyond the standard authorised equipment is the responsibility of the employee.

5. Use of private handheld devices

8. Inventory of mobile handheld devices

11. Unauthorised actions

13. Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals may be subject to loss of the business's information resources access privileges and/or further civil and criminal prosecution.

Introduction

This policy aims to guide The National Debt Review Center Pty Ltd in managing personal information breaches effectively.

2. Scope

This policy applies to all staff. You must be familiar with this policy and comply with its terms. This policy supplements our other policies relating to information use. We may supplement or amend this policy by additional policies and guidelines from time to time.

5. Data breaches

Data breaches may be caused amongst other things, by employees, external parties, third party service providers and computer system errors or vulnerability. Below are a few examples of possible ways in which a data breach can occur:

7. Responding to a data breach

Upon being notified of a suspected or confirmed data breach, the Data Breach Team should immediately activate the data breach management and response plan.

8. Consequences of failing to comply and enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals may be subject to loss of the business's information resources access privileges and/or further civil and criminal prosecution.

Introduction

This policy aims to guide The National Debt Review Center Pty Ltd to classify information within the business.

Purpose

The purpose of this policy is to classify information to ensure that the correct standards and principles are applied to that information.

Scope

This policy applies to all employees, contractors, and other individuals who have access to our information systems, infrastructure, and applications of the business and all records collected, processed, and/or stored by the business and includes, but is not limited to, documents in hardcopy and electronic format, for example, email, web and text files, PDF documents etc.

Responsibility

All of the business's employees share in the responsibility for ensuring that the information receives an appropriate level of protection:

• Managers of the business or information "owners" shall be responsible for assigning classifications to information according to the standard information classification system presented below: "owners" have approved management responsibility, "owners" do not have property rights.
• All employees of the business shall be guided by the information category in their security-related handling of the business's information.
• All information of the business and all information entrusted to the business from third parties fall into one of three classifications in the table below, presented in order of increasing sensitivity.

Information Classification System

Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals may be subject to loss of the business's information resources access privileges and/or further civil and criminal prosecution.

1. Introduction

This policy aims to guide The National Debt Review Center Pty Ltd in managing all aspects related to the Information Systems' use and procedures within the business. This policy and procedures is an overview that consist of various supplementary policies referenced within this policy.

The National Debt Review Center Pty Ltd is required to take appropriate, reasonable technical and organisational measures to protect the information systems, infrastructure, and applications that we possess or control, to prevent unauthorised access, collection, use, disclosure, or similar risks.

For The National Debt Review Center Pty Ltd to prosper and comply with the above stated requirement and its commitment to accountability in terms of POPIA, we need to protect the information and systems entrusted to us. That is why we have created this policy, and the supplementary policies, to ensure that our information is adequate and secured against irresponsible use, breaches of confidentiality, failures of integrity, and interruptions to availability.

2. Scope

This policy applies to:

• All our information, whether electronic or otherwise, in any location.
• All information systems, infrastructure, and applications.
• Employees, contractors, and other individuals who have access to our information systems, infrastructure, and applications.
• IT equipment that includes desktop PCs, laptops, tablets, printers, physical and wireless network, VPN, and all data centre equipment (servers, switches, routers).

3. Purpose

The purpose of this policy is to inform all The National Debt Review Center Pty Ltd employees of their responsibilities and guidelines when making use of and accessing information systems, infrastructure, and applications provided by The National Debt Review Center Pty Ltd, as well as to inform employees of the technical and organisational measures to secure the integrity and confidentiality of all IT systems, infrastructures and applications.

8. Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals may be subject to loss of the business's information resources access privileges and/or further civil and criminal prosecution.

Introduction

This Policy aims to guide The National Debt Review Center Pty Ltd in managing all aspects related to the business's premises that include computers and other types of information technology resources which must be safeguarded against unlawful and unauthorised physical intrusion, as well as fire, flood, and other physical threats.

Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals may be subject to loss of the business's information resources access privileges and/or further civil and criminal prosecution.

1. Purpose

The purpose of this policy is to establish a compliance framework for The National Debt Review Center Pty Ltd to ensure compliance with the Protection of Personal Information Act.

6. Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals may be subject to loss of the business's information resources access privileges and/or further civil and criminal prosecution.

Introduction

This policy aims to guide The National Debt Review Center Pty Ltd in managing all aspects related to data destruction and procedures within the business.

Purpose

Scope

This policy aims to ensure secure disposal of data and personal information regardless of form, and applies to all employees of the business, it's premises and networks as well as visitors and third parties. This policy applies to all information systems owned by the business and includes personal computers, laptops, mobile phones, handheld computers, servers and external or removable storage devices and hard copy materials.

Secure Disposal

• In determining whether a document and/or information should be stored or disposed of, each employee should first refer to the Data Retention Policy and in the event of any uncertainties, to the Information Officer or Deputy Information Officer of the business.
• Under no circumstances should paper documents or removable media (CD's, DVD's, discs, etc.) containing personal or confidential information be simply binned or deposited in refuse bins.
• The business will ensure that all, electronic equipment and data on disk drives be physically removed and destructed in such a way that the data will by no means be able to be retrieved.
• Employees must ensure that all paper documents that should be disposed of, must be disposed of as per the internally approve procedures and then be recycled with the minimum requirement being that the information thereon must be de-identified.
• In the event that a third party is used for data destruction purposes, this third party must also comply with the regulations as stipulated in this policy and any other applicable legislation.

Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals may be subject to loss of the business's information resources access privileges and/or further civil and criminal prosecution.

1. Introduction

This Policy aims to guide The National Debt Review Center Pty Ltd in managing all risk relating to Information Privacy and procedures within the business.

2. Purpose and scope

This policy establishes the process for the management of risks pertaining to personal information faced by the business. The aim of risk management is to maximise opportunities in all the business activities and to minimise risk. The policy applies to all activities relating to the processing of personal information in the business. It is the responsibility of all employees to identify, analyse, evaluate, respond, monitor, and communicate risks associated with any activity, function or process relating to the processing of personal information.

3. Definitions

• "Risk" means risk related to processing of personal information in the business.
• "Risk control" means taking action to first eliminate risk so far as is reasonably practicable, and if that is not possible, minimising the risks so far as is reasonably practicable.
• "Risk management" means the application of a management system and includes identification, analysis, treatment, and monitoring.
• "Risk owner" means the person(s) responsible for managing risks and is usually the person directly responsible for the strategy, activity or function that relates to the risk.

4. Principles

The business is proactive in its approach to risk management, balances the cost of managing risk with anticipated benefits, and undertakes contingency planning in the event that critical risks are realised. The business has the primary duty to ensure the reasonable technical and organisational measures are implemented to minimise internal and external risk.

5. Functions and delegations

The Information Officer must exercise due diligence to ensure that the business complies with POPIA and this policy. This includes taking reasonable steps to:

• gain an understanding of the risks associated with the operations of the business; and
• ensure that the business has and uses appropriate resources and processes to eliminate or minimise risks.

All employees must contribute to the establishment and implementation of risk management systems for all functions and activities of the business. These risk management practices must align with all policies and applicable legislation.

6. Risk management principles

The business must take into consideration the following aspects in adhering to risk management compliance:

7. Role and responsibility of the Information Officer

The business must take into consideration that the elected Information Officer needs to ensure that all employees, subcontractors, representatives, agents and suppliers have a reasonable understanding of the risks associated with the day-to-day responsibilities and operations in ensuring that the business uses all appropriate resources and available processes to eliminate the business's risk element.

8. Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals are subject to loss of the business's information resources access privileges, civil, and criminal prosecution.

Introduction

This policy aims to guide The National Debt Review Center Pty Ltd in managing all aspects related to Surveillance and Monitoring Systems and procedures within the business.

2. Purpose

The purpose of this policy is to regulate:

• the use of the surveillance and monitoring equipment;
• the safety and property of the business, its employees, and visitors; and
• the applicable legal and privacy interests of the business, its clients, and employees.

3. Scope

This policy applies to The National Debt Review Center Pty Ltd, all permanent and temporary employees, contractors, consultants, including all personnel affiliated with third parties who use surveillance cameras in the business and/or conduct surveillance monitoring and recording.

4. Definitions

5. Compliance principles

The business is committed to integrating the best security. The business's use of surveillance cameras for surveillance monitoring or recording must be:

• Conducted in a professional, ethical, and legal manner;
• Compliant with the business's policies and procedures;
• Limited to uses that does not violate a person's reasonable expectation of privacy, as defined by current legal requirements.

6. Procedures

• Installation and/or placement of surveillance cameras in the business premises must be approved by the The National Debt Review Center Pty Ltd management and the Information Officer.
• Only employees designated by the The National Debt Review Center Pty Ltd management and the Information Officer will have access to the images captured by surveillance monitoring or recordings.
• All existing uses of surveillance cameras and surveillance monitoring or recording, subject to this policy, must comply with this policy. A request to continue using the existing surveillance cameras will be submitted to the Information Officer. Network connectivity for surveillance monitoring or recording must comply with the business's policies.
• Violations of these procedures may result in disciplinary action in accordance with the policies, contracts, rules and regulations of the business.

7. Training

The Information Officer will ensure that the designated employees will be trained on the responsible use of the information and technology. Designated employees will also be supervised by a specific supervisor, with periodic review performed by the Information Officer or the Deputy Information Officer.

8. Retention and release of information

• The business will retain images obtained through surveillance monitoring or recording for a length of time deemed appropriate for the purpose, unless such images have historical value, or are being used for a criminal investigation. Any questions regarding the retention of these images should be directed to the Information Officer.
• Only The National Debt Review Center Pty Ltd management and / or the Information Officer can authorise the release of information and results obtained through surveillance monitoring or recording.
• Where third parties have access to The National Debt Review Center Pty Ltd's Surveillance and Monitoring equipment it is the responsibility of The National Debt Review Center Pty Ltd management to enter into Data Processing Agreements with these third parties to ensure data privacy protection.

9. Enforcement

Violation of this policy will result in disciplinary action that may include termination for employees and temporaries, termination of employment relations in the case of contractors or consultants, or dismissal for interns and volunteers. Additionally, individuals are subject to loss of the business's information resources access privileges, civil, and criminal prosecution.