We adopt key principles in our effort to take incremental measured steps to manage our data disclosures.
Transparency
We will be clear and transparent about how we use customers’ information.
Lawful and regulatory bases:
We will only use customers’ information in accordance with relevant laws, and where we have a legal basis for doing so. Where disclosures to law enforcement or other regulatory authorities are required, we will assess and verify these requests, as well as the scope and veracity of data that we are permitted to disclose.
Purpose limitation and data minimisation:
We will only use customers’ information for specific purposes and not more widely for unrelated purposes. We only use and disclose the data necessary for that purpose.
Data transfer
Where we need to transfer customers’ information to another CIMB entity, a third party or another jurisdiction, we will assess whether the transfer is allowed under relevant laws, and whether the receiving party commits to use and protect the data under the same laws.
Third parties
If we use a third-party provider or agent, we will undertake due diligence, monitoring and assurance to ensure our customers’ information is appropriately protected, and that the data is processed to CIMB’s standards and requirements.
