Q: How is access to personal data limited to only those employees who require access for the performance of their function?

A: We have policies in place to limit access to personal data to only those employees who need it for their job functions. This includes defining roles and responsibilities, managing identities, and controlling access rights. We also have physical, electronic, and managerial procedures to safeguard and secure personal information from unauthorized access and misuse.

The principle of ‘Least Privilege’ is applied in our organization to authorize access to information resources, including data and the systems that store or process sensitive data.