Information Security and Personal Data Protection Policy at JSCB «Kapitalbank»

This Information Security and Personal Data Protection Policy in JSCB «Kapitalbank» (hereinafter referred to as the Policy) defines the goals, objectives, and obligations of JSCB «Kapitalbank» (hereinafter referred to as the Bank) in the field of information security and personal data protection.

The Policy is based on the understanding of the Bank's role as a financial institution engaged in the collection, storage, processing, transmission, and protection of confidential information and personal data of clients, partners, employees, and other subjects of personal data.

The Policy ensures information protection in accordance with the Bank's purpose and development strategy, the current legislation of the Republic of Uzbekistan, as well as the requirements of international information security and data privacy management standards: ISO/IEC 27001:2022, ISO/IEC 27701:2019.

The primary objective of this Policy is to ensure reliable and continuous protection of information and personal data held by the Bank against risks of unauthorized access, loss, or misuse.

To achieve this goal, the Bank has defined the following tasks:

1. Ensuring the confidentiality, integrity, and accessibility of information.

2. Protection of personal data at all stages of its processing.

3. Risk management in the field of information security and personal data protection.

4. Compliance with the requirements of legislation, standards, and contractual obligations in the field of information and personal data protection.

5. Increasing the awareness and competence of employees in information security and personal data protection issues.

6. Effective response to information security incidents and ensuring the continuity of the Bank's activities.

7. Regular analysis, control, and improvement of the information security and personal data protection management system.

To fulfill the assigned tasks, the Bank, through its Management Board, assumes the following obligations:

1. Defining the policy and requirements for protecting information and personal data.

2. Determining and making decisions on changing and improving the organizational structure of information security and data privacy management systems.

3. Allocation of sufficient technical, organizational, and human resources for the effective functioning and development of information security and data privacy management systems.

4. Determining the degree of responsibility and duties of Bank employees to ensure information security and personal data protection.

5. Assessment of the effectiveness of implemented measures to protect information and personal data.

6. Continuous improvement of information security and data privacy management systems.