Data Protection & Information Security

1. Purpose

Client data is the raw material of everything IABP does. This statement sets out the technical and organizational measures we apply to it, and to personal information more generally. It supplements our Privacy Policy, which explains what we collect and why.

2. Roles

• Controller. For information collected through this website, and for our own business records, IABP determines the purposes and means of processing.
• Processor. When we process client data to perform an engagement, we act on the client's documented instructions, and the engagement terms govern the processing.
• Sub-processors. Network consultants, implementing partners and service providers engaged on an assignment act under written terms no less protective than our own.

3. Data classification

Handling requirements follow the sensitivity of the information:

• Public — published material. No restriction.
• Internal — business information not intended for publication. Access limited to IABP personnel.
• Confidential — client records, engagement working papers, partner documents. Access limited to the assigned engagement team.
• Restricted — personal data, credentials and anything whose disclosure would cause material harm. Access on a strict need-to-know basis, with additional controls.

4. Technical measures

• Access control. Individual named accounts, role-based permissions, and least-privilege access to engagement folders. No shared accounts for systems holding client data.
• Authentication. Strong password requirements and multi-factor authentication on systems that hold confidential or restricted data.
• Encryption. Encryption in transit for data moving between the client, IABP and partners; encryption at rest on systems that support it.
• Secure exchange. Documents move through agreed secure channels or the client portal, not ad-hoc email attachments.
• Endpoint protection. Managed devices with current operating systems, malware protection and disk encryption.
• Backup and recovery. Regular backups with restoration tested periodically.
• Logging. Access and administrative activity logged on systems holding confidential data.

5. Organizational measures

• Confidentiality obligations. Written confidentiality terms for employees, consultants and partners, surviving the end of the relationship.
• Need-to-know allocation. Access granted per assignment and withdrawn when the assignment ends.
• Training. Data protection and information security awareness for everyone handling client data.
• Partner due diligence. Security and confidentiality terms agreed before any client data is shared with a network partner.
• Segregation. Client engagements kept logically separate; no commingling of client records.
• Clear desk and device disposal. Secure disposal of physical documents and wiping of decommissioned devices.

6. International transfers

IABP operates from Bangladesh and works with partners and clients in several countries, so personal data may be transferred across borders. Where that happens we apply:

• written data protection terms with the recipient, restricting purpose and onward transfer;
• an assessment of whether the destination provides adequate protection, and additional safeguards where it does not;
• data minimisation — only what the assignment requires is transferred; and
• where a client requires it, agreement that data remains within a specified jurisdiction.

Note for counsel: confirm the transfer mechanism to be relied on for EU and UK personal data (standard contractual clauses or equivalent) and reference it explicitly here.

7. Retention and deletion

Engagement records are retained for the period required by applicable law, regulation and professional standards, and for the period during which a claim could reasonably be brought. After that, records are deleted or anonymised. Retention periods for website-collected data are in our Privacy Policy.

On request at the end of an engagement, we will return or delete client data in accordance with the engagement terms, subject to any retention we are legally or professionally required to maintain.

8. Incident response

If a security incident affecting client or personal data occurs, IABP will:

1. contain the incident and preserve evidence;
2. assess the scope, the data affected and the risk to individuals;
3. notify affected clients without undue delay;
4. notify supervisory authorities and individuals where applicable law requires it, within the required period; and
5. remediate the cause and record the lessons in our control framework.

To report a suspected security issue affecting IABP data, email info.iabp@gmail.com with the subject line “Security”.

9. Client responsibilities

Security is shared. We ask clients to send data only through agreed channels, to keep portal credentials confidential, to tell us promptly when a user should no longer have access, and to avoid sending special category or unnecessary personal data where the engagement does not require it.

10. Review

These measures are reviewed at least annually, and whenever a material change to systems, partners or applicable law occurs.

11. Contact

Data protection queries should go to info.iabp@gmail.com, or by post to IABP, House # 12/1/10 (2nd Floor), Road # 2, Shyamoli, Dhaka-1207, Bangladesh. See also our Privacy Policy, Cookie Policy and Quality, Ethics & Professional Responsibility.