Information security management system

A requirement additional to ISO/IEC 27001:2013, 4.4 is: The organization shall establish, implement, maintain and continually improve a PIMS in accordance with the requirements of ISO/IEC... ... - Licensed content not shown -

GDPR (EU)

32.2: Article(32)(2): In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

LGPD (BRA)

Art.13: In conducting studies and research in public health, the research organizations may have access to personal database, which will be processed exclusively within the body and strictly for the purpose of conducting the studies and research and kept in a controlled and secured environment, according to practices outlined in specific regulations and including, whenever possible, anonymization or pseudonymization of the data, as well as considering the due ethical standards related to studies and research. § 1 The disclosure of results or of any excerpt of the study or research contemplated in the head provision of this Article shall not reveal personal data in any case.

Art.44: The processing of personal data is considered irregular when legislation is not followed or when the security that the data subject can expect is not provided, considering relevant circumstances, including: I – The way the processing was performed; II – The result and the risks that can be reasonably expected from the processing; III – The processing techniques available at the time it was performed. Sole Paragraph. The controller or processor that, when failing to adopt the security measures outlined in Article 46 of this Law, cause damage, will be held responsible for a violation of data security.

Art.46: Processing agents must adopt security measures, both technical and administrative, suitable to protect personal data from unauthorized access and accidental or illegal destruction, loss, change, communication, or dissemination events, or any other occurrence resulting from inappropriate or illegal processing. § 1 The National Data Protection Authority may determine minimum technical standards for the purposes of the provisions this Article, considering the nature of the information processed, the specific. characteristics of the processing, and the current state of technology, especially in the case of sensitive personal data, as well as the principles outlined in Article 6 of this Law.§ 2 The measures contemplated in the head provision of this Article must be considered from the phase of the development of the good or service until its execution.

Art.49: The systems used to process the personal data must be structured in order to meet security requirements, best practice and governance standards and the general principles outlined in this Law and other regulatory rules.

CCPA (US, CA)

S.1798.150.a: (a) (1) Any consumer whose nonencrypted or nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action for any of the following: (A) To recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater. (B) Injunctive or declaratory relief. (C) Any other relief the court deems proper. (2) In assessing the amount of statutory damages, the court shall consider any one or more of the relevant circumstances presented by any of the parties to the case, including, but not limited to, the nature and seriousness of the misconduct, the number of violations, the persistence of the misconduct, the length of time over which the misconduct occurred, the willfulness of the defendant’s misconduct, and the defendant’s assets, liabilities, and net worth.

APP (Australian Privacy Principles)

APP.1.2: Must take reasonable steps to implement practices, procedures and systems to ensure compliance with the APPs (APP 1.2)

APP.11.1: Must take reasonable steps to protect personal information held from misuse, interference and loss, unauthorised access, modification or disclosure (APP 11.1)

PIPEDA (Personal Information Protection and Electronic Documents Act) - Canada

4.1: Responsible for personal information under its control and must designate an individual(s) who are accountable for compliance (4.1)

4.7: Personal information must be protected by appropriate security safeguards (4.7)

DPP (Data Protection Principles) - Hong Kong

DPP.4.1: All practicable steps shall be taken to ensure that any personal data (including data in a form in which access to or processing of the data is not practicable) held by a data user is protected against unauthorized or accidental access, processing, erasure, loss or use having particular regard to— (Amended 18 of 2012 s. 40; 17 of 2018 s. 129) (a) the kind of data and the harm that could result if any of those things should occur; (b) the physical location where the data is stored; (Amended 18 of 2012 s. 40) (c) any security measures incorporated (whether by automated means or otherwise) into any equipment in which the data is stored; (Amended 18 of 2012 s. 40) (d) any measures taken for ensuring the integrity, prudence and competence of persons having access to the data; and (e) any measures taken for ensuring the secure transmission of the data.

Personal Data (Privacy) Ordinance - Hong Kong

S.4: A data user must not act or engage in practice that contravenes the data protection principles (S.4)

Personal Data Protection Act - Singapore

S.12: Must develop and implement policies, practices and processes to meet data protection obligations and receive and respond to complaints (S.12)

S.24: Must make reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks for personal data held or under their control

Personal Information Protection Act - South Korea

A.3: Must comply with the Personal Information Protection Principles (A.3)

Turkish Data Protection Law numbered 6698

A.12.1: Must take all necessary technical and administrative measures to provide a sufficient level of security in order to (i) prevent unlawful processing of personal data, (ii) prevent unlawful access to personal data, and (iii) ensure the retention of personal data

A.12.3: Must conduct necessary inspections in order to ensure compliance (A.12.3)