Information security

For PZU, security is an important element in the functioning of a modern insurance institution that affects the Company’s reputation, enhances its credibility and builds client confidence. Therefore, PZU attaches great importance to operating in accordance with the law and the standards set, ensuring a high level of operational security.

Second quarter of each year, the Director of the Security Department submits to the Management Board annually a report on the assessment of the level of security threats for the previous calendar year. Based on this report, the Management Board may oblige the relevant organizational units to take measures to reduce the level of the identified security threat to PZU and PZU Życie.

The policy also creates common security standards for other PZU Group companies. Each Group company participates in achieving operational security goals using common security standards.

Respect for the provisions of the Policy by external entities cooperating with PZU and PZU Życie, based on contracts and agreements, including individuals providing services to the Company under civil law contracts, is one of the priorities of operational security of PZU and PZU Życie.

PZU and PZU Życie implemented principles for client identification and provision of information depending on the client’s requests. Only persons authorized to do so have access to personal data and information covered by insurance secrecy. Authorizations are granted as per the duties performed, through the Central System for Information Security Management (Centralny System Zarządzania Bezpieczeństwem Informacji – CSZBI). In addition, a DLP-class monitoring system was implemented at PZU. Appropriate rules are implemented in the system to minimize the risk of disclosure of information, including personal data, to unauthorized persons. The companies regularly implement and update procedures and safeguards in electronic channels of communication with clients, thereby minimizing the risk of unauthorized disclosure of legally protected information.

A number of additional procedures and rules are also in place, including:

The solutions in place are designed to ensure that each piece of information is protected according to an appropriate level of security, to ensure the control of access to information, the integrity and availability of information, and to prevent theft and unauthorized outflow of information, as well as to ensure an appropriate level of client privacy. Each person whose data is processed by PZU and PZU Życie is entitled to access data and to erase, rectify, complete or modify his or her personal data, and has an opportunity to ask questions concerning privacy. Appropriate processes have been put in place for this purpose, which ensure the exercise of the rights of data subjects, as defined in Articles 12 to 22 of the GDPR¹.

Audits of entities that have been entrusted with personal data processing are conducted by PZU and PZU Życie on a regular basis. During an audit it is verified whether the processing of the entrusted personal data by the processor complies with the GDPR and the agreement for entrusting personal data processing. PZU and PZU Życie also conduct audits of the processors in the case of which security incidents have occurred. Recommendations for changing processes or systems for particular business owners are issued on the basis of audits.

There is a designated Data Protection Officer at PZU who handles the duties of personal data controller (PDC) and a data protection officer (DPO) as prescribed by law, monitors information security incidents, in particular relating to personal data and breaches reported to the President of the Personal Data Protection Office (PUODO), and reports periodically to the Management Board of PZU and PZU Życie.

The scope of reporting as regards the security of the processed data in terms of the identified risks and vulnerabilities includes data on information security incidents, particularly in the area of personal data protection, including information on the implementation of the obligations set forth in Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject) of the GDPR. The ongoing data monitoring of data processing, as well as data analysis and reporting guarantee the transparency and accountability. With the use of the established mechanisms, the areas requiring the implementation of changes are identified and recommendations concerning the improvement of personal data processing security in these areas are issued.

The implemented opinion issuing process encompasses the rollout of new functionalities or changes in the existing functionalities of IT systems, internal documents, processes and contracts in which a personal data related element is or may be present. For this process to be carried out in the best possible way, a dedicated e-mail box has been set up to which queries from business units are sent. Matters are assigned to employees specializing in various data protection areas. The opinion issuing process ends with the issuing of a recommendation in compliance with the applicable provisions on the protection of personal data, judicial rulings, administrative decisions, regulations adopted by PZU and PZU Życie and best market practices. To ensure accountability, all the cases for which opinions have been issued are recorded in a register.

Protecting data and internal systems from the threats posed by cyber-attacks is an important part of PZU’s security management system. The most important goal of ensuring network security is to reduce the risk of cyber-attacks and effectively protect against unauthorized use of data and programs.

On January 23, 2020, the Polish Financial Supervision Authority (Urząd Komisji Nadzoru Finansowego – UKNF) published an announcement regarding the processing of information by supervised entities in public or hybrid cloud computing. The Management Board of PZU designated the Security Department as the coordinating and competent unit for the approval of the implementation of cloud computing-based solutions.

In accordance with the guidelines of UKNF, procedures were adopted to standardize the process of classification and evaluation of information, and the process of risk estimation, i.e.:

• procedure for classification and evaluation of information for the purpose of its cloud computing in PZU and PZU Życie;
• procedure for estimating the risk of cloud computing in PZU and PZU Życie.

Periodical reporting to the Management Board was introduced, as part of quarterly information from the information security area, which includes a list of topics based on cloud solutions to which opinions were issued.

The implementation of the above-mentioned measures has helped to standardize the process of implementing cloud solutions, thus reducing the risk of non-compliance with UKNF guidelines and transparently informing the organization about the actions taken.

Procedures to manage the security of IT processes have been implemented in PZU companies as well as in all foreign companies.

^1. from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR)