Aspirations in data privacy

We make every effort to protect the personal information that comes under our purview. Our data privacy compliance framework is the convergence of international best practices, client-prescribed requirements and applicable data privacy regulations across geographies.

Adopting internationally accepted protocols

We are among the first few organizations globally, to have our framework certified with accreditation, for ISO 27701 privacy information management standard. The objective is to gradually increase the coverage in a phased manner.

Privacy by design EPIC program

Anticipating the need for making privacy an integral part of application development, an organization-wide strategic initiative named EPIC (Embedding Privacy by Design into Infosys Culture) has been rolled out by the Infosys Data Privacy Office in collaboration with Quality team, to embed privacy by design into the solution development process at Infosys which enables and promotes responsible data-centric innovation that complies with data privacy regulations in a way that meets both end-user and client expectations, leading to market differentiation. This program focuses on introducing privacy design strategies, patterns and guidelines to integrate privacy principles and requirements into solutions and platforms development environment. This will also help engineers in making the right design trade off in order to proactively ensure that privacy is a positive sum game.

Privacy impact assessment tool

Keeping in view the large-scale personal data processing involved, we use tools and technologies to institutionalize data privacy practices and controls across the enterprise. Over the years, the growing awareness and education on data privacy among stakeholders has contributed to a more robust process. To make our processes compliant to privacy laws and embed privacy into the design of our systems, Data Privacy Impact Assessments are conducted for every new process or when there is a change in the existing process, which involves processing of PII / SPI. To standardize and automate this process across organization, we developed an in-house tool to recommend customized data privacy controls to the business enabling functions and ensure its effective implementation.

Vendor data privacy guidelines

Vendor data privacy management has assumed strategic significance in data protection and privacy programs, given increasing dependency on outsourcing including cloud service providers. Suppliers present difficult and unique privacy and cybersecurity challenges. Compliance with diverse Data Protection Laws across the world requires an effective mechanism for managing supplier related risks to Infosys. We have published comprehensive guidelines for the suppliers/ vendors to ensure that they adhere to strict obligations imposed both under contracts and from applicable laws of the land, during their engagement with Infosys and its subsidiaries.

Robust incident management and breach handling

At Infosys, we have robust mechanisms to detect, assess, contain and manage data privacy breaches and incidents and well defined processes and procedures to respond to breach notification obligations within defined timelines in accordance with laws of the land. If an incident or a breach is determined to be of high impact, or if the law of land mandates, such breaches are notified to the impacted data subjects and / or supervisory authority. We also incorporate key learnings from incidents by including similar scenarios in privacy awareness stories and tips sent to employees. In fiscal 2022, there were no substantiated complaints received concerning breaches of customer privacy from outside parties and regulatory authorities. There was only one breach identified during the reporting period, outside the organization and where users were notified of the breach.

Data subject rights process

Of late, data subject rights have become an intrinsic part of data privacy laws in many countries. These rights are legally enforceable, but they are never absolute in nature, which makes the fulfilment all the more complex. Infosys has established necessary tools and processes to cater to such data subject rights requests within the stipulated timelines.

Raising Data Privacy awareness through campaigns and events

Every year, we celebrate Data Privacy Day by hosting engaging interventions and diverse online interactive events like crossword, quiz, chat with DPO, messages from senior leaders, among others to spread awareness. The events span over several months and reward mechanisms are in place to promote participation. Additionally, monthly awareness mailers in the form of privacy tips and stories are also sent to everyone in the organization to strengthen awareness. We conducted Privacy Symposium 2021, a maiden virtual conference organized by the Infosys Data Privacy Office in association with IAPP, where participants connected with privacy leaders, CPOs, experts from academia, global frontline practitioners to reflect on key trends, challenges, and best practices. Some of the sessions organized as part of this included privacy engineering, such as anonymization, privacy preserving synthetic data, AI & data ethics and human behavior, privacy standards, data subject rights and other emerging areas. A similar symposium is planned in 2022 in collaboration with international bodies. All employees and sub-contractors have to also mandatorily complete a privacy awareness quiz annually.

Member of IAPP

Our CPO is also a member of the Privacy Engineering Advisory Board of the International Association of Privacy Professionals (IAPP)