China Life has established an information security policy and information security management system to ensure the confidentiality, completeness, and availability of information assets, and also aims to achieve compliance of information operations and services by implementing information security risk management. In response to the expansion and diversity of the insurance business, we made information security internal controls and related regulations applicable to the entire company in 2021. As such, business units not only play the role of user, but also play the role of responsible unit and maintenance unit, which further enhances the Company's overall information security management.

The Company implemented a management system according to the international information security management framework to ensure solid information security. We have also maintained the effectiveness of our ISO 27001 Information Security Management System certification, and improved our protection for customers' rights and interests.

Personal Data Protection and Management System

China Life implemented the personal information management system (PIMS) according to BS 10012: 2017 Personal Information Management System, and embedded personal information protection and management into the corporate culture. China Life expanded the scope of verification to all units in 2020, and completed an applicability evaluation mechanism for the European Union's General Data Protection Regulation (GDPR).

China Life has established a Personal Information Management Committee with the president as the convener. The committee meets every six months and the overall operating status of personal information protection is reported to committee members.

China Life also has a Personal Data Protection Working Group that examines if personal data management, management procedures, and safety management mechanisms are implemented according to plans.