Confidentiality Management

STEP-01

Confidentiality Agreements

---

To inspire trust in the certification body, ICV has established legally enforceable agreements with individuals, committees and external bodies (if any) and individuals working on its behalf, which binds them to maintain confidentiality of the information obtained or created during the performance of audit and certification activities.

• Ref: Record of Confidentiality Agreements

STEP-02

Client Information Protection

---

All client-related information, except that which has been made publicly accessible by the client, is treated as confidential. ICV has informed its clients in advance about the type of their information that the CB intends to place in the public domain.

• Ref: Contract Form for Clients (ICV/F/04)

STEP-03

Disclosure to Interested Parties

---

Confidential information required to be made available to interested parties (e.g. legal or regulatory authorities) under ISO 17021-1:2015 standard, is disclosed on the basis of the certification contract signed by the client.

• Ref: Client's Contract Form

STEP-04

Disclosure to Government Authorities

---

Confidential information of the client required to be disclosed to government authorities as per their written request, is disclosed to them, and the client is informed about the information shared with legal authorities, unless prohibited by law.

• Ref: Record of Govt. Requests for Information and Its Reply

STEP-05

Client Consent Required

---

Confidential information of clients other than those described in para 5.3 and para 5.4, is not disclosed to anyone without getting written consent or permission from the client.

STEP-06

Third-Party Information

---

Information about the client received from sources other than the client (e.g. complainant, regulators) is treated as confidential. Record of such information and of subsequent action, if any, is retained in the client's audit file.

• Ref: Client File

STEP-07

Personnel Obligations

---

ICV has made its personnel, including any committee members, contractors, personnel of external bodies or individuals acting on the certification body's behalf, legally bound to keep confidential all information obtained or created during the performance of the certification body's activities.

• Ref: Agreement / Declaration of Confidentiality

STEP-08

Physical Record Security

---

ICV has made provisions to secure and preserve hard records of confidential information of the clients. Hard files are kept in lockable almirahs and cupboards, accessible only to the CEO, Technical Director and the Operations Manager.

STEP-09

Electronic Data Protection

---

Confidential information in electronic data files is kept password protected, accessible only to the CEO, Technical Director and Operations Manager.

STEP-10

Regulatory Body Sharing

---

ICV takes prior permission from its clients as per its audit and certification contract signed by the client, regarding possible sharing of their confidential information contained in audit reports or files, with certification-related regulatory bodies, if any.

• Ref: Client's Contract Form