Confidentiality Management Procedure

SOP for Confidentiality

Documented Guidelines for Management of Client’s Confidentiality

1.0 Purpose

To lay down documented guidelines for management of client’s confidentiality.

2.0 Scope

This procedure is applicable to all categories of clients who have signed contract for audit and certification with NCIPL.

3.0 Authority

CEO of the CB / CAB is authorized to approve this SOP, while the M R is authorized to issue its controlled copies. The SOP can be amended only by the CEO of the CB.

4.0 Responsibility

Primary: All staff members who are directly involved in certification process.

Secondary: All staff members of the Certification body.

5.0 Procedure

5.1 Legally Enforceable Confidentiality Agreements

To inspire trust in the certification body, NCIPL has established legally enforceable agreements with individuals, committees and external bodies (if any) and individuals working on its behalf, which binds them to maintain confidentiality of the information obtained or created during the performance of audit and certification activities.

Ref: Record of confidentiality agreements

5.2 Treatment of Client Information

Client related all information excepting those that has been made publicly accessible by the client, are treated as confidential. NCIPL has informed its clients in advance about the type of their information, that the CB intends to place in public domain.

Ref: Contract form for clients (NCIPL/F/04)

5.3 Disclosure to Interested Parties

Confidential information required to be made available to interested parties (e.g. Legal or regulatory authorities) under ISO 17021-1:2015 standard, are disclosed on the basis of Certification contract signed by the client.

Ref: Client’s Contract form

5.4 Disclosure to Government Authorities

Confidential information of client required to be disclosed to Govt. authorities as per their written request, is disclosed to them, and the client is informed about the information shared with legal authorities, unless prohibited by law.

Ref: Record of Govt. requests for information, and its reply

5.5 Disclosure with Client Consent

Confidential information of clients other than those described in para 5.3 and para 5.4, are not disclosed to any one without getting written consent / permission from the client.

5.6 Information Received from Other Sources

Information about the client received from sources other than the client (e.g. complainant, regulators) are treated as confidential. Record of such information and of subsequent action if any, is retained in the clients audit file.

5.7 Personnel Bound by Confidentiality

NCIPL has made its Personnel, including any committee members, contractors, personnel of external bodies or individuals acting on the certification body's behalf, legally bound to keep confidential all information obtained or created during the performance of the certification body's activities.

Ref: Agreement / declaration of confidentiality

5.8 Security of Hard Records

NCIPL has made provisions to secure and preserve hard and soft record of confidential information of the clients. Hard files are kept in lockable almirahs and cupboards, accessible only to the CEO, Tech. Director and the Operations Manager.

5.9 Security of Electronic Records

Confidential information in electronic data file is kept password protected accessible only to the CEO, Tech. Director and Operations Manager.

5.10 Sharing with Certification Related Regulatory Bodies

NCIPL takes prior permission from its clients as per its audit & certification contract signed by the Client, regarding possible sharing of their Confidential information contained in audit reports / file, with certification related regulatory bodies, if any.

Record

Record of confidentiality agreements / declarations
Record of requests seeking client’s information and subsequent action
Client file

Refer

Cl. 8.5 of the ISO 17021-1:2015 std.

Section 8.5 of the NCIPL Manual