DATA PROTECTION & PERSONAL DATA GOVERNANCE FRAMEWORK

Document Type: Internal Data Protection Framework
Organisation: CompareMyTrip
Legal Entity: [INSERT LEGAL ENTITY NAME]
Effective Date: [DD/MM/YYYY]
Version: 1.0
Document Owner: [NAME / DESIGNATION]
Approved By: [DIRECTOR / AUTHORISED PERSON]
Review Frequency: At least annually and whenever applicable law, technology, products, suppliers or data-processing activities materially change.

1. PURPOSE

This Data Protection & Personal Data Governance Framework ("Framework") establishes the principles, policies, procedures, responsibilities and controls that CompareMyTrip follows when collecting, processing, storing, sharing, protecting and deleting personal data.

The Framework is designed to help CompareMyTrip:

• Process personal data lawfully and transparently.
• Collect only personal data reasonably necessary for identified purposes.
• Provide appropriate privacy notices.
• Obtain and manage consent where consent is the applicable basis for processing.
• Enable applicable rights of individuals.
• Protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
• Manage third-party data processors and suppliers appropriately.
• Respond to personal-data breaches.
• Establish appropriate data-retention and deletion practices.
• Maintain appropriate records and accountability.
• Protect customer, traveller, employee and business information.

2. SCOPE

This Framework applies to personal data processed by CompareMyTrip through all applicable business channels, systems and services, including:

2.1 Website

• www.comparemytrip.in
• Booking pages
• Enquiry forms
• Contact forms
• Account and login systems
• Cookies
• Analytics and tracking technologies

2.2 Mobile Applications

• Android application
• Future CompareMyTrip mobile applications

2.3 Customer Communication Channels

• WhatsApp
• Meta Business tools
• AI-assisted customer-support systems
• Email
• SMS
• Telephone
• Website chat
• Social-media messaging

2.4 Travel Services

• Flight bookings
• Hotel bookings
• Holiday packages
• Sunrise treks
• Weekend treks
• Monsoon and forest treks
• Transportation
• Visa assistance
• Travel insurance where applicable
• Activities and sightseeing
• Supplier coordination

2.5 Internal Systems

• CRM systems
• Booking systems
• Accounting systems
• Customer-support systems
• Marketing platforms
• Cloud storage
• Email systems
• Employee systems
• Payment systems
• Other technology platforms used for business operations

3. DATA PROTECTION PRINCIPLE

CompareMyTrip follows the following core principle:

Collect what we need, use it for a clear purpose, protect it appropriately, retain it only for as long as necessary, and delete it when it is no longer required.

Personal data shall not be collected, accessed, used or shared unnecessarily.

4. DATA CATEGORIES

Depending on the service requested, CompareMyTrip may process the following categories of personal data.

4.1 Identity Information

• Full name
• Date of birth
• Age
• Gender where required
• Nationality where required
• Government identification information where required

4.2 Contact Information

• Mobile number
• Email address
• Residential or correspondence address
• Emergency contact information
• WhatsApp number

4.3 Travel Information

• Destination
• Travel dates
• Passenger information
• Traveller preferences
• Hotel preferences
• Room preferences
• Flight preferences
• Activity preferences
• Trek information
• Transportation requirements
• Booking history

4.4 Passport and Immigration Information

Where required for a travel or visa service:

• Passport number
• Passport expiry date
• Passport issue information
• Date of birth
• Nationality
• Passport copy
• Visa information
• Visa application information
• Immigration documentation

Passport and immigration information shall be collected only where reasonably necessary for the relevant service or legal requirement.

5. PAYMENT INFORMATION

CompareMyTrip may process transaction-related information such as:

• Transaction ID
• Payment status
• Payment amount
• Payment method
• Payment gateway reference
• Refund status

CompareMyTrip shall not request or intentionally store unnecessary authentication credentials such as:

• ATM PIN
• UPI PIN
• Banking password
• Card PIN
• OTP

Customers must never be asked to disclose such information through WhatsApp, email, telephone, website chat or AI-assisted customer support.

6. CUSTOMER COMMUNICATION DATA

CompareMyTrip may process information provided through:

• Website forms
• Email
• WhatsApp
• Telephone calls
• Customer-support conversations
• Website chat
• Social-media communication
• AI-assisted chat
• Reviews and feedback

Such communications may contain information relating to travel requirements, bookings, preferences and customer support.

7. TECHNICAL INFORMATION

Where applicable, CompareMyTrip may collect or receive:

• IP address
• Browser type
• Device information
• Operating system
• Website activity
• Cookies
• Session information
• Approximate location information
• Referral information
• Analytics information
• Security and diagnostic information

8. PURPOSE LIMITATION

Personal data shall be processed only for identified and legitimate purposes.

Examples include:

CompareMyTrip shall avoid collecting information merely because the technology permits collection.

9. DATA MINIMISATION

Before collecting personal information, CompareMyTrip shall consider:

Is this information actually necessary to provide the requested service or fulfil a legitimate or legal requirement?

Where the information is not reasonably necessary, it should ordinarily not be collected.

10. PRIVACY NOTICE

CompareMyTrip shall provide an appropriate privacy notice when personal data is collected.

The privacy notice should clearly explain:

• What personal data is collected.
• Why the data is collected.
• How the data is used.
• Who the data may be shared with.
• How applicable consent may be withdrawn.
• How applicable data rights may be exercised.
• How privacy complaints may be submitted.
• How personal data is protected and retained.

The notice should be presented in a clear and understandable manner.

11. CONSENT MANAGEMENT

Where consent is the applicable basis for processing, CompareMyTrip shall use an affirmative consent mechanism.

Consent shall not ordinarily be collected through pre-selected or pre-ticked marketing checkboxes.

Example:

☐ I would like to receive travel offers, promotions and updates from CompareMyTrip.

Marketing consent should be distinguishable from information or acknowledgement necessary to provide a requested travel service.

12. BOOKING CHECKOUT CONSENT

Where applicable, the CompareMyTrip checkout process should separately identify:

Terms & Conditions

☐ I have read and agree to the CompareMyTrip Terms & Conditions and Cancellation & Refund Policy.

Privacy Notice

☐ I acknowledge the CompareMyTrip Privacy Notice and understand how my personal data will be processed to provide the requested services.

Marketing

☐ I would like to receive promotional travel offers and updates from CompareMyTrip.

Marketing consent should not be bundled into mandatory booking acceptance.

13. CONSENT RECORDS

Where consent is relied upon, CompareMyTrip should maintain an appropriate record containing, where applicable:

• Customer identifier
• Date and time
• Consent wording
• Consent version
• Purpose
• Communication channel
• Consent status
• Withdrawal date
• Relevant transaction or booking reference

14. WITHDRAWAL OF CONSENT

Where processing is based on consent, CompareMyTrip shall provide an accessible mechanism for withdrawal of consent.

Withdrawal of consent should be reasonably straightforward and should not be unnecessarily more difficult than giving consent.

Withdrawal shall not affect processing that is otherwise permitted or required by applicable law.

Where withdrawal prevents CompareMyTrip from providing a service that requires the relevant data, the customer may be informed of the resulting limitation.

15. DATA PRINCIPAL REQUESTS

Subject to applicable law, individuals may submit requests concerning their personal data.

Such requests may include:

• Access-related requests
• Correction or updating
• Erasure or deletion where applicable
• Withdrawal of consent
• Grievance
• Other rights available under applicable law

Requests shall be submitted to:

Privacy Contact: [NAME / DESIGNATION]
Email: [PRIVACY EMAIL]
Phone: [PHONE NUMBER]

16. IDENTITY VERIFICATION

CompareMyTrip may conduct reasonable identity verification before processing requests involving disclosure, modification or deletion of personal information.

Verification shall be designed to prevent:

• Identity theft
• Unauthorised disclosure
• Fraudulent deletion
• Account takeover

CompareMyTrip shall avoid collecting unnecessary information solely for verification.

17. DATA SHARING

Personal data may be shared with relevant third parties where reasonably necessary to provide the requested service or comply with applicable requirements.

Recipients may include:

• Airlines
• Hotels
• Resorts
• Homestays
• Destination Management Companies
• Trek operators
• Transportation providers
• Activity providers
• Visa service providers
• Government authorities
• Immigration authorities
• Forest authorities
• Payment providers
• Insurance providers
• Technology providers
• Cloud service providers
• Other authorised service providers

CompareMyTrip shall seek to limit information shared to what is reasonably necessary for the relevant purpose.

18. DATA PROCESSOR AND SUPPLIER MANAGEMENT

Before engaging significant technology providers or data processors, CompareMyTrip should assess:

• What data the provider receives.
• Why the provider receives the data.
• Where the data is processed.
• Security safeguards.
• Sub-processors.
• Data retention.
• Data deletion.
• Data breach notification.
• Access controls.
• Contractual obligations.

Relevant supplier and processor arrangements should contain appropriate data-protection obligations.

19. DATA PROCESSOR CONTRACT REQUIREMENTS

Where appropriate, agreements with data processors should address:

1. Purpose limitation.
2. Confidentiality.
3. Security safeguards.
4. Access restrictions.
5. Sub-processors.
6. Data-breach notification.
7. Data retention.
8. Data deletion or return.
9. Assistance with applicable data requests.
10. Compliance cooperation.
11. Security incident management.
12. Applicable legal requirements.

20. INTERNATIONAL DATA PROCESSING

International travel bookings may require personal information to be provided to service providers or authorities located outside India.

Examples include:

• Foreign airlines
• Foreign hotels
• Destination management companies
• Foreign transport providers
• Visa authorities
• Immigration authorities
• International technology providers

Such processing shall be managed in accordance with applicable law and CompareMyTrip's privacy commitments.

21. DATA RETENTION

CompareMyTrip shall retain personal data only for as long as reasonably necessary for:

• Providing the requested service
• Maintaining booking records
• Accounting
• Tax compliance
• Legal compliance
• Contractual requirements
• Dispute resolution
• Fraud prevention
• Security
• Legitimate operational requirements

Different categories of information may have different retention periods.

22. SUGGESTED RETENTION FRAMEWORK

Retention periods should be reviewed with appropriate legal, accounting and tax advisers before final implementation.

23. SECURITY FRAMEWORK

CompareMyTrip shall maintain reasonable technical and organisational safeguards appropriate to the nature, volume and risk of personal data processed.

Security controls should include, as appropriate:

• Encryption
• Masking
• Obfuscation
• Tokenisation
• Access controls
• Authentication
• Logging
• Monitoring
• Backups
• Security testing
• Vendor security controls

24. ACCESS CONTROL

CompareMyTrip shall apply appropriate access controls including:

• Unique user accounts
• Role-based access
• Least-privilege access
• Restricted administrator access
• Periodic access reviews
• Immediate access removal when an employee or contractor leaves
• Restricted access to passport and visa documents

Employees should only access personal data necessary for their role.

25. AUTHENTICATION

Where technically available, CompareMyTrip should use:

• Strong passwords
• Multi-factor authentication
• Secure administrator accounts
• Restricted privileged access
• Password-management controls

Shared administrator credentials should be avoided.

26. PASSPORT AND TRAVEL DOCUMENT SECURITY

Passport and visa documents must be handled with enhanced care.

Employees should:

• Access documents only when necessary.
• Avoid unnecessary downloading.
• Avoid storing documents on personal devices.
• Avoid forwarding documents to personal email accounts.
• Use approved business systems for storage.
• Share documents only with authorised suppliers.
• Delete documents when the approved retention period expires.

27. WHATSAPP DATA PROTECTION

CompareMyTrip's WhatsApp operations shall follow appropriate privacy and security controls.

Employees must never request:

• OTPs
• UPI PINs
• ATM PINs
• Card PINs
• Banking passwords

Employees should avoid requesting unnecessary identity documents.

Passport, visa and other sensitive documents should be exchanged only through approved business channels and stored in approved systems.

28. AI CUSTOMER-SUPPORT DATA

CompareMyTrip may use AI-assisted systems for:

• Frequently asked questions
• Travel enquiries
• Lead qualification
• Customer support
• Travel information
• Enquiry routing
• Booking assistance

AI systems shall operate only within approved access and data-processing boundaries.

29. AI SYSTEM RESTRICTIONS

The CompareMyTrip AI system should not independently:

• Guarantee a booking.
• Guarantee availability.
• Approve refunds.
• Promise compensation outside approved policies.
• Guarantee visa approval.
• Guarantee immigration clearance.
• Alter contractual terms.
• Request OTPs, PINs or passwords.
• Make representations outside approved business information.

Material contractual decisions should be handled or confirmed by authorised CompareMyTrip personnel.

30. AI CUSTOMER DISCLOSURE

Where appropriate, customers should be informed that they may interact with an AI-assisted customer-support system.

Recommended wording:

AI-Assisted Support Notice: CompareMyTrip may use AI-assisted systems to respond to travel enquiries and provide general information. AI-generated responses are not final booking, refund, visa or contractual confirmations unless expressly confirmed by an authorised CompareMyTrip representative.

31. MARKETING DATA

Marketing information should be managed separately from operational booking information.

CompareMyTrip should maintain, where applicable:

• Marketing consent
• Communication channel
• Consent date/time
• Consent status
• Withdrawal date
• Opt-out status
• Suppression status

A customer providing information for a booking should not automatically be treated as having consented to promotional marketing where consent is required.

32. COOKIE AND TRACKING GOVERNANCE

CompareMyTrip should maintain an inventory of technologies used on its website and applications, including:

• Cookies
• Analytics tools
• Advertising pixels
• Remarketing technologies
• Tag-management systems
• Third-party scripts

For each technology, the company should document:

Technology → Purpose → Data Collected → Provider → Retention → Consent Requirement → Website/Application Location

33. EMPLOYEE ACCESS

Employee access shall be based on job requirements.

Sales employees may require:

• Name
• Mobile number
• Email
• Destination
• Travel dates
• Budget
• Enquiry information

Visa employees may require:

• Passport information
• Visa documents
• Travel information
• Supporting documentation

Accounts employees may require:

• Invoice
• Payment reference
• Refund information
• Customer billing details

Employees should not have unrestricted access to all customer information.

34. EMPLOYEE CONFIDENTIALITY

Employees, contractors and relevant business partners who handle personal data should be subject to appropriate confidentiality obligations.

35. PROHIBITED EMPLOYEE PRACTICES

Employees must not:

• Store customer passport copies unnecessarily on personal devices.
• Send customer documents to personal email accounts.
• Share customer information with unauthorised persons.
• Upload customer documents to unapproved AI tools.
• Request OTPs, PINs or passwords.
• Download customer databases unnecessarily.
• Use customer data for personal purposes.
• Sell or disclose customer information.
• Export customer lists without authorisation.
• Use customer data outside approved business purposes.

36. PERSONAL DATA BREACH

A personal-data breach may include unauthorised:

• Access
• Disclosure
• Alteration
• Loss
• Destruction
• Availability compromise
• Other compromise of personal data

Any suspected breach must be reported immediately through the internal escalation process.

37. DATA BREACH RESPONSE PROCEDURE

Step 1 — Detect

Identify the suspected incident.

Step 2 — Report

Immediately report the incident to:

Data Protection Contact: [NAME]
Email: [EMAIL]
Phone: [PHONE]

Step 3 — Contain

Where appropriate:

• Disable compromised credentials.
• Isolate affected systems.
• Stop unauthorised access.
• Preserve relevant evidence.

Step 4 — Assess

Determine:

• What data was affected?
• How many individuals may be affected?
• How did the incident occur?
• Who may have accessed the information?
• What is the potential impact?

Step 5 — Notify

Where required by applicable law, CompareMyTrip shall make appropriate notifications to affected individuals and relevant authorities within the applicable statutory timelines and through prescribed mechanisms.

Step 6 — Remediate

• Correct the vulnerability.
• Reset credentials.
• Improve security controls.
• Address affected systems.
• Document corrective actions.

Step 7 — Review

Conduct a post-incident review and implement appropriate preventive measures.

38. DATA BREACH REGISTER

CompareMyTrip should maintain an internal breach register containing:

• Incident ID
• Date and time detected
• Date and time of incident, where known
• Systems affected
• Data categories affected
• Individuals affected
• Cause
• Containment measures
• Notifications
• Remediation
• Closure date
• Lessons learned

39. DATA DELETION

When personal data is no longer required:

1. Identify the relevant data.
2. Confirm that no legal, contractual or regulatory retention requirement applies.
3. Confirm that no legal hold or dispute requires preservation.
4. Delete or anonymise the data.
5. Delete relevant copies where reasonably practicable.
6. Record completion where appropriate.

Deletion procedures should address applicable:

• Databases
• CRM
• Cloud storage
• Shared drives
• Documents
• Temporary files
• Backups according to the applicable backup lifecycle

40. LEGAL HOLD

Personal data must not be deleted where preservation is reasonably required for:

• Litigation
• Consumer complaints
• Fraud investigation
• Regulatory investigation
• Legal notices
• Tax or accounting requirements
• Contractual disputes
• Other applicable legal obligations

41. CHILDREN'S DATA

Where a booking involves a child or minor, CompareMyTrip shall collect only information reasonably necessary for the requested travel service.

Where applicable under law, appropriate parent or lawful guardian mechanisms shall be followed.

Marketing, profiling and behavioural-monitoring practices involving children shall be handled with particular caution and in accordance with applicable law.

42. CUSTOMER PRIVACY REQUEST WORKFLOW

The standard process shall be:

Customer Request → Identity Verification → Request Logging → Data Identification → Legal/Retention Assessment → Action → Documentation → Response

Customer-support employees should not independently delete, modify or disclose personal data outside the approved process.

43. PRIVACY INCIDENT ESCALATION

Level 1 — Low Risk

Examples:

• General privacy question
• Routine preference update

Handled by customer support or privacy contact.

Level 2 — Medium Risk

Examples:

• Possible unauthorised disclosure
• Suspicious access
• Lost customer document

Escalate to management and the data-protection responsible person.

Level 3 — High Risk

Examples:

• Confirmed significant personal-data breach
• Large-scale unauthorised disclosure
• Compromised customer database
• Major system intrusion

Immediate management, technical and legal escalation is required.

44. THIRD-PARTY REVIEW

CompareMyTrip should periodically review major data processors and suppliers according to risk.

High-priority providers may include:

• Booking technology providers
• Payment gateways
• CRM providers
• WhatsApp/Meta services
• Cloud providers
• Email providers
• Analytics providers
• Flight APIs
• Hotel APIs
• Visa processing providers
• Suppliers receiving passport or traveller information

45. DATA PROCESSOR REGISTER

CompareMyTrip should maintain a register containing:

46. DATA INVENTORY

CompareMyTrip should maintain a master data inventory covering:

Collection Point → Data Collected → Purpose → Applicable Processing Basis → System → Supplier → Retention → Deletion Process

The inventory should be reviewed whenever a new feature, product, supplier or technology is introduced.

47. NEW PRODUCT AND TECHNOLOGY REVIEW

Before introducing:

• A new booking API
• WhatsApp integration
• AI agent
• CRM
• Payment provider
• Analytics platform
• Visa provider
• Customer form
• Marketing platform
• New mobile application

CompareMyTrip should conduct a privacy review.

The review should determine:

1. What personal data will be collected?
2. Why is it required?
3. Is the collection necessary?
4. Who will receive the data?
5. Where will the data be processed?
6. How long will it be retained?
7. How will it be protected?
8. Is consent required?
9. Does the Privacy Policy require updating?
10. Does the supplier agreement require updating?

48. CUSTOMER-FACING PRIVACY DOCUMENTS

CompareMyTrip should maintain the following customer-facing documents as applicable:

Core Documents

• Privacy Policy
• Data Protection Notice
• Terms & Conditions
• Cancellation & Refund Policy
• Cookie Policy
• Grievance Redressal Policy

Recommended Additional Notices

• WhatsApp & AI Customer Communication Notice
• Visa Data Processing Notice
• Trek & Adventure Data/Safety Notice
• Marketing Communication Notice

49. WEBSITE IMPLEMENTATION

The CompareMyTrip website should provide accessible links to:

**Terms & Conditions
Privacy Policy
Cancellation & Refund Policy
Cookie Policy
Grievance Redressal**

Where applicable, checkout should provide:

☐ I acknowledge the CompareMyTrip Privacy Notice.

Marketing should use a separate optional mechanism:

☐ I would like to receive travel offers and promotional communications from CompareMyTrip.

Trust Guarantee bookings should separately state:

☐ I understand that the CompareMyTrip Trust Guarantee applies only to eligible bookings specifically identified as covered.

50. DATA PROTECTION RESPONSIBILITY

CompareMyTrip shall designate an internal person responsible for coordinating privacy and data-protection matters.

Responsible Person: [NAME]
Designation: [DESIGNATION]
Email: [EMAIL]
Phone: [PHONE]

The responsible person may coordinate:

• Privacy requests
• Data incidents
• Supplier compliance
• Policy updates
• Employee training
• Data inventory
• Retention
• Security escalation
• Privacy audits

The internal title used by CompareMyTrip shall not be represented as a statutory Data Protection Officer unless the applicable law requires or permits such designation.

51. EMPLOYEE TRAINING

Employees who handle personal data should receive periodic training covering:

• Data-protection principles
• Customer privacy
• Password security
• Phishing
• WhatsApp security
• Passport-document handling
• Customer verification
• Data sharing
• AI usage
• Breach reporting
• Data retention
• Data deletion

52. DATA PROTECTION AND MARKETING

Information collected for fulfilling a customer's booking should not automatically be treated as marketing consent where separate consent is required.

Operational communication and promotional communication should be appropriately distinguished.

53. DATA PROTECTION AND SUPPLIERS

Before sharing traveller information with a supplier, employees should consider:

Is this information necessary to fulfil this booking or service?

If yes, it may be shared through an approved business channel.

If no, it should not be shared.

54. RECORD KEEPING

CompareMyTrip should maintain appropriate records relating to:

• Privacy notices
• Consent records
• Consent withdrawals
• Data-principal requests
• Privacy complaints
• Data breaches
• Processor contracts
• Data inventories
• Retention schedules
• Security reviews
• Employee training
• Privacy assessments
• Supplier reviews

55. ANNUAL REVIEW

At least annually, CompareMyTrip should review:

• Privacy Policy
• Data inventory
• Processor register
• Retention schedule
• Security controls
• Consent mechanisms
• Cookie technologies
• AI systems
• WhatsApp workflows
• Supplier data-sharing arrangements
• Breach history
• Applicable laws and regulations

A review should also be conducted whenever there is a significant:

• Technology change
• Product change
• Supplier change
• Data-processing change
• Legal or regulatory change
• Security incident

56. COMPLIANCE DASHBOARD

Management should periodically review the following:

57. DOCUMENT HIERARCHY

The CompareMyTrip privacy programme shall operate through the following hierarchy:

Level 1 — Applicable Law and Regulations

↓

Level 2 — CompareMyTrip Data Protection & Personal Data Governance Framework

↓

Level 3 — Privacy Policy and Customer Privacy Notice

↓

Level 4 — Internal Data Protection SOPs

↓

Level 5 — Employee Procedures and Training

↓

Level 6 — Technical and Organisational Controls

58. LEGAL COMPLIANCE PRINCIPLE

Nothing in this Framework, Privacy Policy, Terms & Conditions or any other CompareMyTrip document shall be interpreted as:

• Waiving a statutory right;
• Avoiding a mandatory legal obligation;
• Preventing an individual from exercising a lawful remedy;
• Removing any obligation imposed on CompareMyTrip by applicable law.

Where applicable law provides a higher level of protection, the applicable law shall prevail.

59. MANAGEMENT APPROVAL

This Framework shall be approved by an authorised representative of CompareMyTrip.

Approved By: __________________________________

Designation: __________________________________

Date: __________________________________

Signature: __________________________________

60. VERSION CONTROL

COMPAREMYTRIP DATA PROTECTION IMPLEMENTATION CHECKLIST

Legal and Governance

Exact legal entity name inserted

Registered office inserted

Privacy contact appointed

Official privacy email created

Grievance Officer identified

Management approval obtained

Framework version recorded

Data Management

Master data inventory created

Personal-data collection points identified

Data-processing purposes documented

Data-sharing register created

Processor register created

International data flows identified

Retention schedule approved

Deletion process implemented

Website

Privacy Policy published

Privacy Notice implemented

Terms & Conditions published

Cancellation & Refund Policy published

Cookie Policy published

Grievance Redressal published

Consent mechanisms reviewed

Marketing opt-in separated

Trust Guarantee disclosure implemented

Booking Systems

Flight data flow reviewed

Hotel data flow reviewed

Visa data flow reviewed

Trek data flow reviewed

Payment data flow reviewed

Supplier access reviewed

WhatsApp and AI

WhatsApp data flow documented

Meta/AI data processing reviewed

AI disclosure implemented

AI access restrictions implemented

Staff prohibited-data instructions issued

Customer document handling procedure implemented

Security

Role-based access implemented

Administrator access restricted

MFA enabled where available

Security logs enabled where appropriate

Backup process implemented

Passport document access restricted

Employee access review implemented

Breach-response procedure established

Employee Compliance

Employee privacy training completed

Confidentiality obligations documented

Personal-device restrictions communicated

Personal-email restrictions communicated

AI-tool usage policy communicated

Breach reporting procedure communicated

Ongoing Compliance

Annual privacy review scheduled

Processor review scheduled

Access review scheduled

Retention review scheduled

Security review scheduled

Legal/regulatory review scheduled

END OF COMPAREMYTRIP DATA PROTECTION & PERSONAL DATA GOVERNANCE FRAMEWORK