Information Security Framework

The MIS employs a comprehensive security framework designed to safeguard systems, applications, and data. Our security approach is based on industry best practices and government security guidelines, incorporating multiple layers of protection.

Access to sensitive functions and information is restricted to authorized users based on defined roles and responsibilities through Role-Based Access Control (RBAC). The system supports 22+ distinct roles across 11 sectors, each with appropriate access permissions.

Data Protection Principles

Personal and organizational data processed through the MIS is handled in accordance with applicable data protection principles, including:

• Lawful Processing: Data is collected and processed only for legitimate purposes
• Purpose Limitation: Data is used only for the purposes for which it was collected
• Data Minimization: Only necessary data is collected and processed
• Accuracy: Steps are taken to ensure data accuracy and currency
• Storage Limitation: Data is retained only for as long as necessary
• Confidentiality: Appropriate measures to protect data confidentiality
• Integrity: Measures to ensure data integrity and prevent unauthorized modification
• Accountability: Clear responsibility and accountability for data protection

User Responsibilities

Users of the MIS play a critical role in maintaining system security. By accessing the system, users agree to comply with established security requirements and best practices:

• Credential Security: Keep login credentials confidential and never share accounts or passwords
• Strong Passwords: Use strong, unique passwords and change them periodically
• Secure Access: Access the system only from secure, trusted devices and networks
• Logout: Always log out from shared or public devices after use
• Report Incidents: Report suspected security incidents or vulnerabilities immediately
• Data Accuracy: Ensure information provided is accurate and up-to-date
• Compliance: Follow all security policies and procedures
• No Unauthorized Access: Do not attempt to access areas or data beyond your authorization

Violation of security requirements may result in account suspension, termination, or legal action as appropriate.

Incident Management

In the event of a data security incident or suspected breach, Workers Welfare Fund will take prompt action to:

• Contain: Immediately contain the incident to prevent further damage
• Investigate: Conduct a thorough investigation to determine the scope and impact
• Remediate: Address vulnerabilities and restore normal operations
• Notify: Notify affected users and relevant authorities as required by law
• Document: Document the incident and lessons learned
• Improve: Implement improvements to prevent similar incidents

Incident response procedures are regularly tested and updated to ensure effectiveness. All security incidents are documented and reviewed to improve our security posture.

Data Breach Notification

In the event of a data breach that may affect your personal information, we will:

• Notify affected users as soon as reasonably possible
• Provide information about the nature of the breach
• Explain steps being taken to address the breach
• Offer guidance on protective measures users can take
• Comply with legal notification requirements

Notifications will be sent via email or other appropriate channels to the contact information on file.

Security Best Practices for Users

To help protect your information and maintain system security, we recommend:

• Use strong, unique passwords and enable two-factor authentication if available
• Keep your browser and operating system updated
• Be cautious of phishing attempts and suspicious emails
• Verify the authenticity of communications claiming to be from WWF
• Report suspicious activity immediately
• Regularly review your account activity and information
• Do not share your login credentials with anyone
• Use secure networks when accessing the system

Policy Updates

This Security & Data Protection statement may be updated periodically to reflect changes in technology, regulatory requirements, or system enhancements. Updates will be published on this page with a revision date.

Significant changes will be communicated to users through appropriate channels. We encourage users to review this statement periodically to stay informed about our security practices.

Last Updated: December 29, 2025