Control Objectives: Privacy protection for information and data

As stated in the Roche Code of Conduct, "Any information related to an identified or identifiable person must be collected and processed in compliance with applicable data privacy laws (e.g. Swiss Federal Act on Data Protection, EU General Data Protection Regulation and the US Health Insurance Porta

Check that personal data is complete.

Check the accuracy of personal data.

Collect data in a fair and lawful way.

Collect data in a proper information framework.

China publishes CSL (Cyber Security Law), DSL (Data Security Law) and PIPL (Personal Information Protection Law) and the relevant regulations and demands are rapidly evolving. Given the law is broad in nature, the expectation of this control is that you involve China Legal and China information Secu

Projects must ensure solutions/services processing Personal Data of US residents are compliant with the requirements set forth in the applicable US national and state-level privacy laws.

It must be ensured that all legally required privacy information (e.g. “privacy policy”/”privacy notice” and text used for consent) is provided correctly and at the right point in time.

Control data elements that contain any password, Personal Identification Number, or Card Security Code as restricted data.

As required by the EU General Data Protection Regulation (GDPR), a Data Protection Impact Assessment (DPIA) report must be created to identify and minimise the data protection risks.

Define personal data that falls under breach notification rules.

Define the confidentiality requirements for collecting and processing privacy-related data and privacy-related information.

Develop organizational measures to limit data leakage.

Develop remedies and sanctions for privacy policy violations.

Display or print the least amount of personal data necessary.

Dispose of data and information in a timely manner.

Encrypt, truncate, or tokenize data fields as necessary.

Establish and maintain a Customer Information Management program.

Establish and maintain a purpose specification for privacy-related data use.

Establish and maintain data and information confidentiality policies.

Establish and maintain data handling policies.

Establish and maintain data handling procedures.

Establish and maintain guidelines and procedures for personal data retention or Personally Identifiable Information retention.

Establish and maintain personal data access procedures.

Establish and maintain personal data collection limitation boundaries.

Establish and maintain procedures that define privacy-related data use limitations.

Establish and maintain record structures to support information confidentiality.

Establish and maintain transparency and openness while protecting the privacy of personal data.

In the US a Roche HIPAA Privacy Officer must review the project deliverables and confirm if HIPAA requirements are met.

Implement procedures to file privacy rights violation complaints.

Include data elements that contain an individual's payment card information as personal data that falls under the breach notification rules.

The Legitimate Interest Assessment (LIA) documents the key aspects to be considered when balancing the benefit to the Data Controller (e.g. Roche) against the potential impact/risk to the Data Subject (i.e. individual). This is required to support the decision that the "legitimate interest" of the

Maintain personal data in a form that does not permit the identification of data subjects for longer than the processing purpose.

Notify individuals of their right to challenge personal data.

Post the privacy policy in an easily seen location.

Maintain up-to-date information related to the solution or service in the Roche Privacy Register as required by the applicable data privacy laws and regulations

Privacy protection for information and data

Prohibit data elements containing payment card security codes (Card Authentication Value 2, Card Validation Code Value 2, Card Verification Value 2, Card Identification Number) from being stored.

Prohibit personal data from being sent by e-mail or instant messaging.

Specify who will receive the privacy policy.

DoJ DSP Assessment by Roche US Legal

Verify data elements that contain the full magnetic stripe data from a payment card are not stored under any circumstance.

As a Digital Channel Owner, you are responsible for the digital compliance of your product. The website, web application, or mobile application must satisfy different regulatory requirements considering the type and targeting region. This may include the obligation to obtain consent via opt-in or of