Legal

Data Policy

This Data Policy outlines our approach to handling digital data, cybersecurity, and technology development in line with globally recognised standards.

1. Introduction

This Data Policy outlines our approach to handling digital data, cybersecurity, and technology development in line with globally recognised standards. It ensures compliance with best practices.

2. Principles for Digital Development Compliance

Our systems and procedures adhere to the Principles for Digital Development, specifically:

  • Design with the user: We prioritise stakeholder needs in all platform and tool designs.
  • Data-driven decision-making: Decisions are informed by accurate, regularly updated data.
  • Privacy and security: We enforce strong safeguards to ensure data privacy and security.

3. Data Governance

3.1 Data Collection and Use

  • We collect data lawfully, transparently, and solely for specific, legitimate purposes.
  • Personally identifiable information (PII) is collected only when necessary and is encrypted in storage and transmission.

3.2 Data Storage and Access Control

  • Data is stored securely using encrypted servers (AES-256).
  • Regular backups are scheduled, tested, and stored securely.

3.3 Data Sharing and Transfers

  • Data is only shared externally under contractual agreements that guarantee confidentiality and ethical use.
  • International data transfers are conducted under GDPR-compliant mechanisms.

4. Cyber Essentials Security Policy Alignment

We align with the Cyber Essentials framework through the following measures:

4.1 Firewalls and Secure Configurations

  • All network traffic is monitored through a central firewall with strict access rules.
  • Default passwords and configurations are always changed during deployment.

4.2 User Access Control

  • Access is reviewed quarterly to ensure continued relevance.

4.3 Malware Protection

  • Regular scans and updates are automated.

4.4 Patch Management

  • Operating systems and applications are patched within 7 days of critical updates.
  • Patching is verified and logged through automated system management tools.

5. Incident Response and Breach Notification

We maintain an Incident Response Plan that includes:

  • 24-hour response time to cybersecurity incidents.
  • Internal reporting channels and a review process for all incidents.
  • Notification to affected parties and authorities within 72 hours (if required).

6. Monitoring, Review, and Continuous Improvement

This policy is:

  • Reviewed annually or in response to a significant change in systems or regulations.
  • Accompanied by internal audits, penetration testing, and compliance checks.
  • Integrated into employee onboarding and training programs.

7. Policy Approval and Ownership

This policy is approved by the senior leadership team and enforced by the Data Protection Officer (DPO) and IT Security Manager. All staff are required to read and acknowledge this policy.

Signed

Ishaq Bolarinwa

CEO, Anfani

Talk to us