Governance

1. The personal data protection rules are applied to personal data related to business processes conducted by the company, whether already stored or to be collected in the future.
2. Personal Data Protection is implemented for all personal data within its scope, based on priorities, and in line with the provisions of the personal data protection governance policy.
3. Personal data protection must be implemented within the compliance framework established in the information security management system policy and must refer to applicable data security standards.
4. The planning of personal data protection must include the annual implementation plan for personal data protection provisions. This plan must cover the data scope and implementation milestones, the involved stakeholders, and the identification of critical issues related to the plan along with their mitigation strategies.
5. The confidentiality level of the processed personal data must be determined to define the security mechanisms to be applied, referring to the applicable Data Security Guidelines.
6. The established confidentiality level must be documented as metadata for each piece of personal data.
7. For every stage of personal data processing, security mechanisms corresponding to the data confidentiality classification must be applied, referring to the applicable Data Security Guidelines.
8. For personal data that was stored and collected in the past without the written agreement of the data owner, if processing of such data is required, the company must submit a request for data processing consent to the respective data owner.
9. The request for data processing consent must provide at least 2 options: Agree and Disagree. Alternatively, an option to consent to only part of the request may be added.
10. If the data owner mentioned in point 2 agrees to the request, the company may process the said data, but only for the purposes approved by the data owner.
11. If the data owner mentioned in point 2 refuses or cannot confirm the consent request, the company is not permitted to process that personal data.
12. Under the condition mentioned in point 5, if there is a situation that necessitates the company to process the data, the data can only be processed by removing personal identifiers from it, using a K-Anonymity mechanism.

1. The responsibility for implementing personal data protection includes responsibility for:

   1. Planning the implementation of personal data protection

   2. Monitoring and Evaluating the implementation of personal data protection

   3. Reporting on personal data protection

   4. Acquisition and Collection of personal data

   5. Processing & Analysis of personal data

   6. Storage of personal data

   7. Correction and updating of personal data

   8. Display, announcement, transfer, dissemination, or disclosure of personal data

   9. Deletion/destruction of personal data

   10. Fulfillment of data subject requests

2. The roles in the implementation of personal data protection include:

   1. Data Subject

   2. Data Protection Officer – PDP Governance Officer

   3. Data Protection Officer – PDP Services

   4. Data Controller

   5. Data Processor

   6. Data Source

   7. Related Functions

1. Prospective Employees: External personnel undergoing the recruitment process to become employees, through various recruitment methods conducted.
2. Employees: Personnel serving as staff, both active and inactive, who have routine rights and obligations to the company. Employees include organic employees, contract employees, interns, personnel in work practice programs, and retirees.

3. Customers: Includes customers who are life insurance participants or general insurance participants.

4. Event Participants: Participants of activities organized by the company, both routine and occasional events. Events include activities such as free homecoming programs, survey activities, competitions, exhibitions, etc.

5. Partner's Persons in Charge (PIC): Personnel representing organizations that use products/services organized for B2B purposes. Partner PICs include PICs from ceding companies or reinsurance companies.

6. Supplier's (Vendor's) Persons in Charge (PIC): Personnel representing supplier/vendor companies.

7. SLR Program Recipients (Social and Environmental Responsibility): Personnel representing organizations or individuals who receive benefits from the SLR programs organized by the company.

8. Entity Visitors/Guests: External personnel entering the company's work area for a specific purpose.

9. Directors/Commissioners: Personnel holding strategic roles in the company. A special grouping for this personal data is due to the sensitivity of the data and the potential reputational risk arising from the misuse of personal data within this group.

For further information regarding Indonesia Re's Personal Data Protection, you can contact us at:

Indonesia Re Building
Jl. Salemba Raya No. 30
Central Jakarta 10430
Email: cosecretary@indonesiare.co.id