VNS Accounting Solutions Pvt. Ltd.
Data Security Policy
1. Introduction
At VNS Accounting Solutions, we are committed to ensuring the confidentiality, integrity, and availability of all data entrusted to us by our clients. This Data Security Policy outlines the principles, measures, and practices followed by VNS Accounting Solutions to protect sensitive data across all services, including bookkeeping, tax returns, tax consultancy, CFO services, and DCA compliance.
2. Scope of the Policy
This policy applies to:
-
All data related to bookkeeping, tax return preparation, and filings.
-
Client information used for tax consultancy, CFO services, and strategic financial guidance.
-
Records and documents related to DCA compliance and government contracts.
-
All staff, contractors, and third parties involved in providing services at VNS Accounting Solutions.
-
All digital and physical data storage mediums used by the company.
3. Data Classification
Confidential Data: Client financial records, tax documents, personal information, business operations data, DCA compliance records, and government contract details.
Internal Data: Non-sensitive information such as internal communication, administrative records, and employee data.
Public Data: Information publicly available or released by clients.
4. Data Protection Principles
-
Confidentiality : Data shared only on a need-to-know basis with proper consent.
-
Integrity: Data must be accurate, complete, and regularly updated.
-
Availability: Data accessible to authorized personnel when required.
5. Data Security Measures
5.1 Data Encryption
-
All sensitive client data must be encrypted during transmission and at rest using industry-standard protocols.
5.2 Access Control
-
Access restricted to authorized personnel based on roles.
-
Use of strong passwords, Multi-Factor Authentication (MFA), and Role-Based Access Control (RBAC).
5.3 Regular Audits & Monitoring
-
All data access must be logged and monitored.
-
Regular audits conducted to ensure compliance and identify improvements.
5.4 Data Minimization
-
Only necessary data will be collected.
-
Avoid unnecessary data retention.
5.5 Data Retention and Disposal
-
Data retained only as long as required by purpose and legal requirements.
-
Secure deletion or destruction when no longer needed.
6. Training and Awareness
-
Mandatory data security training for employees, contractors, and third parties.
-
Periodic refresher training to ensure compliance.
7. Incident Response
-
Immediate activation of incident response team.
-
Investigation and client notification as per legal requirements.
-
Corrective actions to prevent recurrence.
8. Third-Party Security
-
Third-party vendors must follow similar security practices.
-
Formal agreements must include data protection clauses.
9. Compliance with Legal and Regulatory Requirements
-
GDPR (if applicable)
-
Data Protection Act 2018Tax
-
Compliance Regulations
-
DCA (Department of Company Affairs) Compliance
10. Continuous Improvement
-
Regular review and updates to address evolving threats and regulations.
-
Feedback from clients and staff used to improve security practices.
11. Policy Review
-
Reviewed annually and updated as necessary.