Confidential Information Management Rules
Creation date: December 1, 2015
Revised date:
General Provisions
Objective
This document is written in order to prevent confidential information leak, falsification, loss and unauthorized use by defining how to protect and handle confidential information owned by Thai Kyowa Biotechnologies Co., Ltd. (hereinafter referred to as [TK]),.
Compliance obligation and scope of application
The rules shall apply to those who are engaged in the business of TK such as directors, employees, contract employees and part-time staff, etc. (hereinafter referred to as [employees, etc.]).
The employees, etc. are obliged to follow the defined rules in a conscientious manner.
When outsourcing part of the business, a contract implemented in relation to the rules on this document shall be exchanged so that the outsourced company will comply with the rules on this document.
Definition of Confidential Information
[Confidential Information] on this document indicates the information or knowledge which has not become public knowledge and include any information related to management, technology, sales, personal, contracts, policies, ideas, know-how, quality, standards and facilities as well as tangible entities such as equipment, instruments, microbes, cells and chemical compounds.
Confidential information includes not only literal but also audio, video and photographic information. The literal information includes not only information written in paper, but also email messages, electronic files recorded in external storage (such as optical disks) and their draft versions.
Classification of Confidential Information
Classification of confidential information (hereinafter referred to as [information category]).
Confidential
By disclosing or leaking to other parties outside TK, this will or may bring loss or damage to TK. The information can be subject to the protection under confidentiality law in Thailand as a trade secret.
Strictly Confidential
By disclosing or leaking to other parties outside TK, this will or may bring significant loss to TK or penalized. The information shall be disclosed to the limited group of people only (e.g. Top level management information).
Other confidential information
Confidential information other than [Confidential] or [Strictly confidential] criteria. The information shall be internal use only and should not be disclosed to external people.
General rules for information sharing
Employees shall not store any confidential information under their personal management without any apparent reason. They shall endeavor to share information in accordance with the rules on this document as well as other internal rules and standards.
Handling confidential information
Confidential information shall not be disclosed or passed without prior consent from TK. This also applies after leaving office or retiring from work.
Even within the office, confidential information shall not be disclosed outside the related parties.
Confidential information shall not be used outside the business in charge or intended business purpose.
Confidential information shall not be disclosed or passed by means of audio, video or photography.
A group of information that include any [Confidential] or [Strictly Confidential] information is considered as [Confidential] or [Strictly Confidential] as a whole.
Confidential information written in Article 4 3) shall be regarded as [Internal Use Only] whenever possible. Any confidential information not classified specifically shall be treated as [Internal Use Only].
Handling information from external companies
All information received with obligation of confidentiality in an appropriate manner shall be treated as confidential information and follow the rules on this document. However, if the information is outside the scope of application of this document and specified separately, the appropriate agreement/contract shall be prioritized.
Information security manager
Information Security Manager
The person responsible of information security throughout TK is the President.
In principle, assign Information Security Manager.
Information Security Managers can assign deputy managers. In principle, deputy managers are the head of each department.
Roles and responsibilities of Information Security Managers
The President and Information Security Managers shall manage and promote all aspects of information security in an appropriate manner.
President and Information Security Managers shall make sure that appropriate confidential information will be protected in accordance with the rules as well as give appropriate training to the employees in order for them to understand and follow the rules.
Handling [Confidential] and [Strictly Confidential] information
Information category and specifying scope of disclosure target (hereinafter referred to as [scope of disclosure])
Information to be specified as [Confidential] and [Strictly Confidential] should be kept to the minimum.
Specifying [Confidential] or [Strictly Confidential] shall be carried out in the following manner; the creator of the information (hereinafter referred to as [the creator] applies for the classification, then the Information Security Manager of his/her department approves it.
When specifying as [Confidential] or [Strictly Confidential], it is also required to define the scope of disclosure.
In the case of [Strictly Confidential] information, it should be registered to the appropriate book and managed with a unique registration number.
Change/cancellation of information category and scope of disclosure
For [Confidential] and [Strictly Confidential] information, change/cancellation shall be completed by the approval of the Information Security Manager of an appropriate department.
In the case of [Strictly Confidential] information, enter the detail of the revision (for change) and the reason (for change or cancellation) in the appropriate book.
Specifying information category and scope of disclosure
The creator shall clearly specify the information category and scope of disclosure after gaining an approval from his/her Information Security Manager.
Setting a step to restrict viewing/access to the information
The creator shall take necessary steps to prevent the information from being accessed easily by people outside the scope of disclosure.
Viewing/access restriction
[Confidential] and [Strictly Confidential] information shall not be viewed or accessed by those people outside the scope of disclosure. In case anyone outside the scope of disclosure view/access the information, he/she needs to acquire prior approval from the specified department of the information or from the Information Security Manager of his/her own department.
Restriction on replication, copying and printing (hereinafter referred to as [copies, etc.])
When making copies, etc. of [Confidential] information, keep it to the minimum. [Confidential] information is, in principle, not allowed to be copied by people outside the scope of disclosure.
[Strictly Confidential] information is, in principle, not allowed to be copied. When anyone is making copies, etc. due to inevitable reasons, he/she shall acquire prior approval from the Information Security Manager of the appropriate department.
Restriction on forwarding, sending and distribution (hereinafter referred to as [forwarding, etc.]
[Confidential] information is, in principle, not allowed to do forwarding, etc. to people outside the scope of disclosure. Those people who have received such information, should not forward to anyone else. However, Article 19 [Return] shall not apply to this clause.
[Strictly Confidential] information is, in principle, not allowed to do forwarding, etc.. When anyone is forwarding, etc. due to inevitable reasons, he/she shall acquire prior approval from the President. However, Article 19 [Return] shall not apply to this clause.
Restriction on taking out
[Taking out] means anyone who belongs to the scope of disclosure is taking out the confidential information by means of paper or electronic copy on the encrypted personal computer or electronic medium such as an encrypted USB memory stick or CD/DVD. The information handled internally by email, by post or in-house mail within a company does not apply to this clause.
[Confidential] and [Strictly Confidential] information should be internal use only in principle. In the case if anyone needs to take out such information outside the company due to inevitable reasons, he/she shall acquire prior approval from the President or from the Information Security Manager. Whenever [Strictly Confidential] information is taken outside TK, record it on the appropriate book.
If any [Confidential] or [Strictly Confidential] information is recorded on electronic devices such as personal computers or electronic media and when the appropriate electronic devices or electronic media is taken outside the company, the users of the electronic devices or electronic media shall take responsibility of the hardware and information ensuring to prevent loss, theft and information leak.
Storage
[Confidential] or [Strictly Confidential] information should be stored under the management of Information Security Managers.
Information Security Managers and deputy managers should check the status of storage condition appropriately and give training to their own department staff for how to store information properly.
Information Security Managers and deputy managers shall make constant effort to maintain and enhance security of the storage location and storing method by checking locking status, restricting access, alarm system, access right management etc..
Return
When receiving [Confidential] or [Strictly Confidential] information with a due date, it must be returned to a specified person by the due date.
Destruction/elimination
Information Security Managers must destruct/eliminate [Confidential] or [Strictly Confidential] information that i