Regulations Governing Security Protection Plans for and Processing of Personal Information Files by Tourist Amusement Enterprises Article 3

A tourist amusement enterprise that keeps personal information files may refer to Articles 4 to 20 in setting up proper security protection measures.A Protection Plan set up by a tourist amusement enterprise shall include the following items, which may be combined when necessary:1.Designating management personnel and appropriate information sources.2.Defining the scope of personal information and stipulating periodic checks.3.A personal information risk assessment and management mechanism.4.An accident prevention, notification and response mechanism.5.An internal management procedure for personal information collection, processing and use.6.Measures for the management of equipment security, information security, and personnel.7.A mechanism for checking information security.8.Keeping records, tracking data and evidence of use.9.Conducting guidance and training related to personal information.10.Comprehensive ongoing improvement of personal information security protection.11.Method of disposal of personal information after termination of business.