Regulations Governing the Security Assurance Plan and Processing Method for Personal Data of the Engineering Consulting Industry Article 2

These Regulations are applicable to professional engineering consulting firms (hereinafter referred to as “the consulting firm”) which are defined by the Act Governing the Administration of Professional Engineering Consulting Firms.The consulting firm shall set up the security assurance plan for personal data (hereinafter referred to “the Assurance Plan”) and take appropriate security measures to prevent personal data from being stolen, altered, damaged, destroyed or disclosed.The Assurance Plan shall include the relevant organizations and procedures prescribed in Articles 3 to 21, and it shall be reviewed regularly and amended in conformity with related laws and regulations.An operator of the consulting firm shall set up the Assurance Plan as mentioned in paragraph 2 before obtaining the registration certificate for consulting firm. A consulting firm obtained the registration certificate prior to the effectiveness of these Regulations shall set up the Assurance Plan within six months since the effectiveness of these Regulations.