Cybersecurity and Personal Data Protection

Cybersecurity and Personal Data Protection

To ensure that the Company's information technology systems, network systems, and computers maintain the highest level of security. For sustainable business operations, system and data security are crucial for user confidence. As the Company's business involves collecting, storing, and processing a large amount of personal data of employees and applicants, the Company places great importance on protecting and maintaining this data, especially in an era where technology access and cyberattacks are becoming increasingly complex.

The Company has established information technology system security control processes in accordance with ISO/IEC 27001, the international standard for Information Security Management Systems (ISMS). Furthermore, the Company complies with the "Personal Data Protection Act B.E. 2562 (2019) (PDPA)" by developing a Personal Data Protection Policy to serve as a guideline for directors, executives, employees, and relevant parties to ensure compliance and legality in their work.

Goal

• 0 incidents of internal data leakage.
• 0 cases of personal data breach complaints
• 0 cyber security incidents impacting operations

Operational Results

• Development and Testing of Critical System Recovery Plans: The company annually develops and conducts simulation exercises for critical system recovery. The IT department performs these recovery tests to ensure business continuity in the event of an emergency. The testing includes simulating various cyber threat scenarios to evaluate recovery capabilities. The results confirmed that all systems were successfully restored to normal operations in accordance with the established recovery plan.
• Provide communication channels and educate employees on cybersecurity: The Information Technology Department provides communication and education on cybersecurity through various channels such as the Company's Line Application, Intranet system, and Email, to disseminate knowledge and publicize news to raise awareness and build a foundation for cybersecurity protection and the use of the Company's information systems. This also includes organizing data security training for new employees.
• Number of cases or incidents related to cybersecurity or customer data leakage