Personal Data Protection Policy

As a specialized cybersecurity company, AhnLab fully recognizes the importance of protecting personal information. All employees are committed to fulfilling their social responsibility to safeguard personal information throughout every stage of its processing by adhering to the following principles.

Information Security and Personal Data Protection Management Framework

As the importance of information security and personal data protection continues to grow in the digital era, AhnLab collects and uses personal information in a transparent and systematic manner. AhnLab has established a comprehensive information security and personal data protection management framework to protect personal information and prevent harm to its customers throughout this process.

AhnLab manages the personal information of all customers in accordance with its Privacy Policy. AhnLab minimizes the collection of personal information and does not use it for purposes other than those for which it was collected or disclose it to third parties.
Personal information collected in connection with services is retained and used only for the period to which the customer has consented, beginning on the date of consent. Once the retention period expires, the purpose of collection has been fulfilled, or there is a request to withdraw from the service, the relevant personal information is promptly destroyed without delay. When personal information is deleted, AhnLab takes appropriate measures to ensure that it cannot be restored or reconstructed.

Information Security and Personal Data Protection Organization

Information Security and Personal Data Protection Goals and Key Initiatives

Information Security and Personal Data Protection Management System Review and External Verification

AhnLab conducts annual internal security consulting to identify vulnerabilities in its information assets. When vulnerabilities are identified, risk assessments are performed to determine acceptable risk levels and identify risks requiring mitigation. Based on the assessment results, enhanced security controls are established and implemented for risks deemed significant.

AhnLab also performs regular and ad hoc vulnerability assessments of its website, applications, and key business systems. Corrective action plans are established for identified vulnerabilities, and follow-up reviews are conducted to verify that remediation has been completed. Additionally, AhnLab undergoes annual certification audits by independent external organizations to maintain its information security certifications.

Information Security and Personal Data Protection Activities

AhnLab conducts annual Distributed Denial of Service (DDoS) defense drills to assess and strengthen its DDoS defense capabilities. The Company also carries out personal data leakage response exercises to enhance its ability to respond promptly to security incidents, notify affected customers of personal information leakages, and report such incidents to the relevant authorities. AhnLab provides online training on information security and personal data protection for all employees, ensuring they stay up to date on the latest developments in these areas. To strengthen preparedness against Advanced Persistent Threats (APTs), AhnLab conducts monthly APT phishing simulation exercises. The Company also calculates and shares monthly team security scores to promote security awareness.
AhnLab also requires all personal information processors (service providers) to enter into security management agreements that mandate compliance with technical, physical, and administrative information security controls. Compliance with these agreements is regularly monitored through periodic assessments. AhnLab provides information security training materials to contractors, including outsourced personnel and requires them to submit proof of training completion.