Data Protection and Privacy – CISS International

Updated On: 10th November 2025.

As part of our international expansion, CISS GH Corporation (“CISS”, “we”, “our”, or “us”) is committed to protecting the data and rights of all individuals and organizations we interact with. This policy outlines our approach to data protection and privacy in line with global standards and national laws across the United States, United Kingdom, European Union, and Africa.

This documentation is part of CISS International Docs and applies to all clients, users, employees, contractors, and partners operating or interacting with us across borders.

Global Privacy Compliance

CISS is scaling its operations to comply with the following key data protection regulations:

Region	Law	Key Compliance Focus
United States / Canada	CCPA, CPRA (California), HIPAA (where applicable)	Consumer privacy, opt-out rights, data sale disclosure.
European Union / United Kingdom	EU and UK GDPR, Data Protection Act 2018	Lawful processing, transparency, and data protection.
Africa	Ghana Data Protection Act 2012 (Act 843)	Local consent frameworks, data storage and disclosure obligations

EU GDPR and UK GDPR

The EU GDPR, which came into effect on May 25, 2018, is a comprehensive data protection framework designed to ensure the lawful and fair processing of personal data of individuals within the European Union. The UK GDPR, also known as the United Kingdom General Data Protection Regulation, is the UK’s domestic data protection legislation that aligns closely with the EU GDPR.

The Information Commissioner’s Office (ICO) is the UK’s independent authority responsible for upholding information rights and enforcing data protection regulations. It plays a crucial role in enforcing the UK GDPR and provides guidance and support to organizations in understanding and complying with their data protection obligations. The ICO has the power to investigate data breaches, issue fines, and take enforcement action against non-compliant organizations.

Non-compliance of these regulations can result in severe consequences, including financial penalties, reputational damage, and legal liabilities. Therefore, all CISS clients operating in these regions must learn, understand, keep updated, and comply with the requirements of these regulations including payment of fees (if needed) to avoid any consequences.

If your business, organization, app, or website collects and processes user data within the EU and UK, please adhere to the requirements of the EU and UK GDPR. CISS will not be responsible for any penalties.

Data Security Measures by CISS

CISS implements technical and organizational security measures powered by CISS SDS (Security and Defense System) to protect personal data from unauthorized access, loss, or misuse, including:

• Regular system upgrades with latest security updates
• End-to-end encryption for web traffic and emails
• Role-based access control (RBAC) for staff systems
• Regular internal audits and vulnerability assessments
• Two-factor authentications for secured portals
• Secure cloud infrastructure with global redundancy

Breach Notification Protocol

In the event of a data breach affecting personal data we will:

• conduct internal investigation and remediation,
• notify affected individuals and relevant supervisory authorities within the legally required timeframes,
• and alert clients and partners with full transparency.