Did your company make “privacy policy” and/or “Personal Information Protection Regulation”?
And do your company publish it on your company’s web site?
Collecting the personal information of your customers’, suppliers’, and your company’s employers’ and managing them is a mandatory.
Needless to say, management of them carefully is must to do things. So also, it is important to declare how to keep and control them safely, and this is required by a Personal Information Protection Law.
Personal Information Protection Law requires you to show the individuals the purpose and a contents of their personal information before or immediate after acquisition.
Additionally it is a requirement of the law that, if you will keep them and use them as data, you must inform the individuals the way to protect them safely, when they require to know it.
The Personal Information Protection Law has another close the must-declare items to handle the personal information. Please check your company’s “Privacy Policy” and/or “Personal Information Protection Regulation”, whether it is satisfy the requirement of the law. If your company does not have these documents, I recommend you to make them followed by the law requirement.
But, I understand it is very difficult to say how much you need to write about “how to keep and control them safely, and the way to protect them safely”. I can help you clear your worries and create the documents if you like, so please feel free to contact me.