Highlights of Personal Data Protection Management System: ISO 27701

To comply with regulatory amendment trends of competent authorities and supply chain management system requirements, the introduction of the ISO 27701 Privacy Information Management System is planned and evaluated. In 2025, current-status risk identification was conducted, and regulatory applicability, impact scope, and gaps within the scope were confirmed. The evaluation results shall be applied to the group-level privacy protection mechanism and system established in 2026; furthermore, the personal data management system and privacy governance framework
are established in accordance with PDCA, and personal data inventories and registries, privacy impact assessments (PIA), and risk appraisal operations are executed.

In addition, a personal data protection task force has been established to handle consultations, complaints, the exercise of personal data subjects' rights, and emergency notifications, and an external consultant has been appointed to serve as the Data Privacy Officer (DPO). Certification is expected to be obtained in 2027 after the introduction of the privacy protection mechanism and system establishment are perfected.

Enhancing Risk Prevention and Safeguarding the Realization of Creditors' Rights

Great emphasis is placed on enhancing the efficiency of accounts receivable recovery. Debt protection is continuously strengthened and accounts receivable risks are mitigated by the legal unit, in collaboration with business units and credit management units through cross-departmental communication and collaboration, and relevant promotion mechanisms and educational training are continuously planned. This includes the "Legal Micro-Course Series" online training courses, through which colleagues can conduct online self-study or offline presentations can be arranged by
the legal unit, aiming to enhance colleagues' relevant capabilities through promotion and course offerings.

Regulatory Compliance Promotion

To enhance compliance awareness across departments, reinforce corporate governance, and protect investor interests, the Legal Affairs Service launched the "Compliance Training Series" in 2025. An online platform was established to provide live streams and course videos, allowing regional employees to learn flexibly at any time. To reinforce key concepts, online assessments were conducted following each session. In 2025, 12 courses were held, recording 19,568 participant attendances.

 ➲Return to Corporate Governance