Regulatory Compliance and Data Privacy and Cybersecurity
Regulatory Compliance
Comprehensively and continuously assess and monitor compliance with laws, regulations, and requirements relevant to business operations.
Maintain zero confirmed significant cases of non-compliance with laws or regulatory requirements annually.
Develop systems to oversee and monitor changes in laws and regulations, with ongoing communication to relevant functions.
Integrate compliance risks into the enterprise risk management process.
Promote an organizational culture of compliance with laws, regulations, and business ethics at all levels of the organization.
Data Privacy and Cybersecurity
Maintain zero confirmed significant cases of personal data breaches or data leakage annually.
Maintain zero cybersecurity incidents that significantly impact business operations annually.
Ensure that personal data-related complaints are investigated, responded to, and resolved within the timeframe specified by the Company.
Continuously enhance personal data protection and cybersecurity management systems, including regular testing of incident response plans.
Ensure that 100% of employees receive communication or training to raise awareness of PDPA and cybersecurity by 2029.
Regulatory Compliance
No significant disputes or violations of laws were identified.
No significant fines or penalties arising from non-compliance with laws were identified.
Relevant laws and regulations applicable to business operations are continuously monitored and reviewed.
Compliance Reports are prepared for the organization’s significant activities.
Compliance risk management is integrated into the Enterprise Risk Management (ERM) process.
Data Privacy and Cybersecurity
No significant personal data breach incidents were identified.
No cyberattacks with a significant impact on business operations or critical systems were detected.
No complaints regarding personal data privacy violations were received.
Continued to review and enhance the Incident Response Plan and Disaster Recovery Plan.
Conducted ongoing communication and awareness programs on personal data protection and cybersecurity for employees across the organization.
Challenges and Opportunities
Regulatory Compliance
Challenges
The Company operates under a broad range of applicable laws, regulations, and requirements covering environmental management, occupational health and safety, labor practices, corporate governance, and industry-specific obligations. As these requirements continue to evolve, the Company must continuously monitor regulatory developments, assess potential impacts, and enhance its operational processes to ensure ongoing compliance.
Opportunities
Strict compliance with applicable laws and regulatory requirements helps mitigate legal and regulatory risks, enhances stakeholder confidence, and supports transparent and sustainable business operations.
Data Privacy and Cybersecurity
Challenges
The transition to the digital era has led organizations to become increasingly dependent on information technology systems and data. As a result, risks related to personal data protection and cybersecurity threats have become more complex and are evolving at a rapid pace.
Opportunities
An effective personal data management and cybersecurity framework enhances trust among customers, suppliers, employees, and other stakeholders, while supporting the Company's digital transformation journey and long-term business resilience.
Management Approach and Value Creation
Regulatory Compliance
- Continuously monitor and review laws, regulations, and requirements relevant to the Company's business operations.
- Integrate compliance risk management into the Enterprise Risk Management (ERM) framework.
- Establish appropriate internal controls and operational procedures to ensure compliance.
- Foster a corporate culture that promotes legal compliance, ethical conduct, and good corporate governance.
- Regularly report compliance performance and regulatory matters to management and the Board of Directors.
Data Privacy and Cybersecurity
- Manage personal data in compliance with the Personal Data Protection Act (PDPA).
- Develop and periodically review the Record of Processing Activities (RoPA) and Data Flow Mapping.
- Implement access controls for personal data and information systems.
- Enhance cybersecurity capabilities for the prevention, detection, and response to cyber threats.
- Maintain and regularly review the Incident Response Plan and Disaster Recovery Plan.
- Promote cybersecurity and data privacy awareness among employees across the organization.
- Continuously monitor and strengthen information security measures to address evolving risks and threats.
Stakeholders Directly Impacted
