Standards, regulations & privacy.
Our commitment to data protection
At essensys, we recognise the importance of the data we collect and process on behalf of our customers. essensys’ robust privacy and security program meets the highest standards in the industry. essensys is consistent with ISO 27001 and ISO 9001.
What customers should do
Get buy in and build a team
- Raise awareness of the importance of GDPR compliance with organization leaders
- Obtain executive support for necessary staff resources and financial investments
- Choose someone to lead the effort
- Build a steering committee of key functional leaders
- Identify privacy champions throughout the organization
Assess the organisation
- Review existing privacy and security efforts to identify strengths and weaknesses
- Identify all the systems where the organization stores personal data and create a data inventory
- Create a register of data processing activities and carry out a privacy impact assessment for each high-risk activity
- Document Compliance
Establish controls and processes
- Ensure privacy notices are present wherever personal data is collected
- Implement controls to limit the organization’s use of data to the purposes for which it collected the data
- Establish mechanisms to manage data subject consent preferences
- Implement appropriate administrative, physical, and technological security measures and processes to detect and respond to security breaches
- Establish procedures to respond to data subject requests for access, rectification, objection, restriction, portability, and deletion (right to be forgotten)
- Enter into contracts with affiliates and vendors that collect or receive personal data
- Establish a privacy impact assessments process
- Administer employee and vendor privacy and security awareness training
Document compliance
- Compile copies of privacy notices and consent forms, the data inventory and register of data processing activities, written policies and procedures, training materials, intra-company data transfer agreements, and vendor contracts
- If required, appoint a data protection officer and identify the appropriate EU supervisory authority
- Conduct periodic risk assessments
essensys Information Security Policy
essensys has set forth in our business plan information security objectives consistent with ISO 27001. Department and project managers are informed and trained on these objectives for incorporation into their respective roles and teams.
We stand by the following on-going security objectives:
- Information is only accessible to authorised persons from within or outside the organisation and levels of access are determined by CIO or by delegated authority.
- Confidentiality, integrity and availability of information and systems are maintained.
- Business continuity plans are established, maintained and tested.
- All personnel are trained on information security and are informed that compliance with the policy is mandatory.
- All breaches of information security and suspected weaknesses are to be reported to the CIO and investigated and appropriate actions taken.
- Relevant procedures exist to support the policies in place.
- Regular audits of the processes and policies are conducted to ensure continuous review and improvement of the IBMS.
- New systems or services are deployed in a controlled and secure manner
- As far as is possible, essensys avoids breaches of legal, regulatory and contractual requirements.
Whilst the above company objectives are high-level, we have further analysed and categorised these into our Risk & Opportunities Matrix. In some cases, this may allow for specific objectives to be set across different functions. This demonstrates how we measure and set targets in meeting the high-level objectives.
