Information Security & AI Policy Statement

2.1 Legal and Regulatory Compliance

Nathan Digital shall comply with international standards and data protection laws, including:

• Kenya Data Protection Act, 2019 (KDPA)
• South Africa POPIA
• EU/UK GDPR & UK DPA 2018
• UAE PDPL – Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
• Saudi Arabia PDPL
• Singapore PDPA
• Canada PIPEDA

In addition to these regulations, we ensure that all AI systems are developed, deployed, and operated in line with ISO 42001 (AI Governance), which includes:

• Ethical AI Principles: Fairness, transparency, and accountability.
• Compliance with AI-Specific Legal Requirements: Meeting the legal requirements for AI models that process personal or sensitive data.
• Privacy Protections: Ensuring privacy when AI models process personal data.

2.2 AI Risk Management and Ethical AI Framework

We have established and implemented a comprehensive AI Risk Management Framework to identify, assess, and mitigate risks associated with AI models, including:

• Bias and Fairness Risks: Addressing potential biases in AI models and ensuring fairness in decision-making.
• Transparency and Explainability: Ensuring that AI models and their outcomes are explainable and understandable.
• Security and Privacy Risks: Protecting personal and sensitive data processed by AI systems.

This framework will ensure that AI systems operate securely and ethically, meeting the requirements of both ISO 27001 and ISO 42001.

2.3 Incident Management and AI Monitoring

We have established a comprehensive Incident Management Process as part of our Information Security Management System (ISMS) and AI Governance Framework. This process ensures that all information security incidents, including those involving AI systems, are reported, investigated, and remediated promptly. We continuously monitor our AI models for issues like performance degradation, security vulnerabilities, and bias, ensuring that they remain secure, ethical, and aligned with our standards. All AI-related incidents are handled in accordance with our ISMS protocols, ensuring compliance with ISO/IEC 27001 and ISO 42001, and safeguarding the integrity and security of both our AI systems and the data they process.

2.4 Resource Allocation for ISMS and AI Governance

Nathan Digital will ensure that appropriate resources are allocated to:

• Implement, maintain, and continually improve our ISMS and AI governance frameworks.
• Conduct regular AI risk assessments, including AI-DPIAs (AI Data Protection Impact Assessments).
• Allocate personnel with the required expertise to manage both information security and AI ethics.

2.5 Communication of the Policy

This policy will be communicated to:

• All Nathan Digital employees and relevant third-party providers.
• External stakeholders to ensure transparency and alignment with ISO 27001 and ISO 42001 governance practices, as well as applicable data protection laws.
• Customers and partners, ensuring their trust in our products and services.

2.6 External Partnerships and AI Collaboration

We shall establish and enhance partnerships with external providers and relevant interested parties to:

• Provide improved AI-driven products and services.
• Ensure the ethical and secure use of AI systems in collaboration with external partners.

2.7 Information Security and AI Objectives

We establish, document, measure, monitor, review, and continually improve our Information Security and Artificial Intelligence (AI) objectives in alignment with our Information Security Policy Manual, ISMS, and AIMS, in accordance with the requirements of ISO/IEC 27001:2022 and ISO/IEC 42001:2023.

These objectives focus on protecting the confidentiality, integrity, and availability of information, strengthening cybersecurity controls, managing information security and AI-related risks, preventing security incidents and data breaches, and ensuring compliance with applicable legal, regulatory, contractual, and data protection requirements, including GDPR where applicable.

Additionally, our objectives promote the responsible, secure, transparent, and ethical development, deployment, and use of AI systems through effective AI governance, risk assessments, appropriate human oversight, and continuous improvement of AI security and ethical controls.

We regularly evaluate the effectiveness of these objectives through defined performance indicators, risk assessments, internal audits, management reviews, and corrective actions to ensure their continued relevance, effectiveness, and alignment with organisational goals.

2.8 Continuous Improvement of Information Security & AI Governance

Management at Nathan Digital acknowledges the need for continual improvement. We have implemented various processes to ensure effective and continual improvement of our ISMS and AI governance practices, including:

• Regular reviews and updates of AI ethical practices and security controls.
• Regular management reviews of both the ISMS and AI Governance to align with emerging risks, regulatory changes, and technological advancements.
• Performance tracking of AI systems, data privacy, and security measures to ensure continual alignment with business objectives.

Nathan Digital management acknowledges the need for continual improvement and has introduced various methods to ensure effective and continual improvement of the processes.

Further, information security objectives have been established and are reviewed periodically to ensure continual improvement of our ISMS and AIMS.

2.9 Compliance with ISO 27001, ISO 42001 & SOC 2 Type II

This policy ensures that Nathan Digital is aligned with the core principles of ISO 27001 (Information Security Management), ISO 42001 (AI Governance), and SOC 2 Type II (Trust Services Criteria). We ensure:

• C

  Confidentiality

  Protecting sensitive information from unauthorized access.

• I

  Integrity

  Ensuring the accuracy and reliability of data and AI systems.

• A

  Availability

  Guaranteeing that systems and data are accessible when needed by authorized users.

• P

  Privacy

  Ensuring that personal data is processed securely and with respect to privacy rights.