Information Security Management System Requirements

• Document and Control of Records Process

• Control of Non-Conforming Services Process

• Corrective and Preventive action Process

• Internal Audit & Management Review Process

• Statement of Applicability

• Risk Management Process

1 Introduction ..............................................................................................................................2

2 Definitions ................................................................................................................................3

3 Objectives ................................................................................................................................3

4 Compliance to Protection of Personal Information and GDPR. ..............................................4

6 Responsibilities: .......................................................................................................................6

7 Processes Procedures ............................................................................................................7

8 Supporting Policies ..................................................................................................................8

The relationship of Saryx Engineering Group with its clients, employees and directors is based on

mutual integrity and trust and it is always therefore committed to maintaining this trust by

protecting the privacy of personal information and data disclosed and received from any data

subject or data owner and to the best of its ability.

The Management of Saryx Engineering Group subscribes to the goals and principles of data

privacy and information security in line with relevant legislation and its business strategy and

objectives. Data privacy and information security is an integral component of the information

management structure of Saryx Engineering Group.

Saryx Engineering Group has an obligation to ensure appropriate security of all Information

Technology (IT) systems (data, equipment and processes) and personal information that it owns

Saryx have a well-documented Information Security Management policy which contains the IT

security elements and responsibilities ISMP.01- Information Security Management Policy (ISMP)

automatic means, concerning personal information, including:

a) the collection, receipt, recording, organisation, collation, storage, updating or

modification, retrieval, alteration, consultation or use.

form; or merging, linking, as well as restriction, degradation, erasure or destruction of

information.

in conjunction with others determines the purpose of and means for processing personal

information.

person, and where it is applicable, an identifiable, existing juristic person.

3 Objectives

• POPIA and GDPR requires consumer to be aware as to the manner in which their

personal information is used, protected, disclosed and destroyed.

• Saryx Engineering Group guarantees its commitment to protecting the consumer’s

privacy and ensuring that their personal information is used appropriately, transparently,

b) General Data Protection Regulation (hereinafter GDPR)

c) Adhere to both Legislative requirements.

Since there is overlap between the POPIA act and GDPR which ever requirement of either of the

Two acts is most restrictive will be applied. For example the minimum age of data subject consent

is 16 years of age in the EU whereas in South Africa the Legal age is 18. In this instance the most

restrictive would be South Africa.

4 Compliance to Protection of Personal Information and GDPR.

4.1 Data subjects pertaining to Saryx have the following rights;

• Objection to the use of personal information.

• Notification if information is being used for something other than what was consented for.

• Establishing whether the responsible party holds information.

4.2 Conditions for lawful processing

4.2.1 Accountability

• The Responsible party must ensure that the conditions set out in the POPIA Act and

GDPR and all the measures that give effect to such conditions, are complied with at the

time of the determination of the purpose and means of the processing and during the

processing itself.

4.2.2 Processing Limitations

• The Data subjects must consent.

• Consent is necessary to carry out actions to conclude or perform a contract to which the

data subject is a party.

• The Data subject must be at least 18 years of age.

4.2.3 Specific Purpose

Personal Information must be collected for a specific, explicitly defined and lawful purpose related

to the function or activity of the responsible party. The data subject must be made aware of the

purpose of the collection.

Records must not be retained any longer than is necessary for achieving the purpose for which it

was collected unless;

• further retention is required by law;

• the responsible party is reasonably required to keep it;

• retention is required by a contract between the parties;

5.1 Offshoring of Data

employees and contractors, at which time login IDs are revoked.

The logon ID is locked or revoked after a maximum of three (3) unsuccessful logon attempts. The

Users who desire to obtain access to Company systems or networks must have a completed and

signed Network Access Form. This form must be signed by the supervisor or department head of

each user requesting access.

7.3 Suppliers and Providers

Any supplier process data on behalf of Saryx Engineering Group, these suppliers need to

evidence their compliance to the POPIA act or GDPR during the on Boarding Phase and must be

verified annually.

https://xneelo.co.za/legal.

8 Supporting Policies

Saryx Engineering Group have a documented set of policies and procedures that have been

entrenched and manged via the HSEC Online software with all data cloud based.

Saryx have a page defining Terms and conditions for users

https://www.hsec.co.za/Account/ShowTermsConditions