Public Policy Advocacy and Regulatory Engagement Policy

1. Purpose

This policy sets how the Organisation takes part in public policy discussions and engages with governments, regulators and industry bodies on laws, standards and regulation that affect cybersecurity, data protection, technology and its customers. It makes sure that engagement is honest, lawful, in the public interest and traceable.

• Engagement adds expert, evidence-based views and supports a safe and trusted digital environment.
• Nobody acts for the Organisation in these matters without authority.
• The Organisation never uses engagement to gain an improper advantage.

2. Scope

The policy applies to all directors, employees, contractors, consultants, agents and intermediaries who engage with public bodies or take part in policy discussions for or on behalf of the Organisation.

• In scope: meetings and correspondence with ministries, legislators, regulators, standards bodies and public agencies; responses to consultations; participation in trade associations, think tanks and working groups; public speaking and publications on policy; and use of intermediaries or lobbyists.
• In scope: topics such as cybersecurity regulation, data protection, cross-border data, AI, communications and technology rules, public procurement rules, standards and certification schemes.
• Out of scope: routine statutory filings, tax and licence returns, regulator inspections and incident reports, which follow their own procedures, and operational contact with a regulator that does not concern policy, such as handling of incident notifications under the Information Security Incident Management Policy.

3. Terms and Definitions

4. Policy Objectives

• Contribute to rules that are workable, proportionate and in the public interest, based on facts and expertise.
• Keep the Organisation's positions consistent with its values, its published commitments and the law.
• Prevent corruption, conflicts of interest and misrepresentation.
• Keep an accountable record of who engaged, with whom, on what and with what result.
• Support the ISMS requirement to maintain contact with authorities and special interest groups.

5. Roles and Responsibilities

6. Guiding Principles

6.1 Ethical conduct and integrity

• Engagement must be truthful and not misleading. Statements must be supported by evidence and clearly distinguish fact from opinion.
• Personnel must declare who they represent. They must not claim to speak for the Organisation without authority, nor use their title in personal views.
• Information obtained improperly, such as confidential government documents or leaked drafts, must not be used or sought.

6.2 Transparency

• The Organisation is open about its positions. Where it takes part through an association, it states its own position if it differs from the association's.
• The register of memberships and the main positions are published or made available on request.

6.3 Alignment with public and national interest

• Positions must be consistent with the public interest, including security, privacy and trust in digital services, and with national laws.
• The Organisation does not argue for weaker security or privacy protections for individuals in order to gain commercial benefit.

6.4 Accountability and documentation

• Each engagement is recorded in the engagement log with date, participants, topic, position, outcome and follow-up.
• Positions and submissions are approved before release and kept with the log.

6.5 Anti-corruption and compliance

• The Organisation prohibits offering, giving, requesting or accepting any bribe or improper advantage, directly or through an intermediary, in any country, in line with applicable anti-bribery and anti-corruption law.
• Gifts, hospitality, travel, sponsorship or employment offers to public officials, or to their relatives, are prohibited unless the policy owner has approved them in writing in advance and they are modest, lawful, transparent and recorded. A limit of [a modest value set by the policy owner] applies to any single item.
• Facilitation payments are prohibited.
• Political contributions in the Organisation's name, with its resources or on its premises, are prohibited unless the Board approves them and they are lawful and disclosed. Personal political activity is a private matter and must not be linked to the Organisation.

6.6 Participation in industry platforms

• Membership of an association, standards body or working group needs approval of the policy owner and must be recorded in the register of memberships, with its purpose, fee and the representative.
• Representatives must not use a platform for anti-competitive purposes, such as exchanging pricing or customer information, and must leave a meeting where such a discussion begins, and report it.
• Memberships are reviewed [every 12 months] for value and alignment with the Organisation's positions.

7. Public Policy Advocacy and Regulatory Engagement Statements

7.1 Preparing an engagement

• Before any planned engagement, the spokesperson must submit an engagement plan (Annexure A) stating the topic, the audience, the position, the evidence and the ask, and receive approval from the policy owner at least [3 working days] before the engagement.
• Unplanned approaches by public officials must be handled by the person approached by saying only what they are authorised to say, taking contact details, and reporting to the policy owner.

7.2 During engagement

• A second person should attend meetings with public officials where practicable, to take a note and to serve as witness.
• Personnel must not offer anything of value, must not commit the Organisation to a position not already approved, and must not disclose customer data, personal data or confidential information.
• Where the Organisation is asked for views on a rule that affects its own supervisory status or licences, Legal must be consulted first.

7.3 After engagement

• The spokesperson must record the engagement in the log within [5 working days], with a note of any commitment or request and who will follow up.
• Any suggestion or request that looks improper must be reported to the policy owner at once, who decides whether Legal or the Board must be told.

7.4 Consultation responses and public statements

• Written responses and published articles on policy must be reviewed by Legal and the Communications lead and approved by the policy owner before release.
• Statements must be consistent with the Organisation's published policies, including the Data Protection and Privacy Policy and the Information Security Policy.

7.5 Intermediaries and lobbyists

• An intermediary may be engaged only after due diligence, a written contract that prohibits improper payments and requires disclosure of its dealings, and approval of the policy owner.
• Payments to intermediaries must be by transfer to an account in the intermediary's name, against an invoice that describes services in detail, and reviewed by Finance.

7.6 Conflicts of interest

• Personnel with a personal, family or financial connection to a public official or body involved in an engagement must declare it to the policy owner before taking part.
• Hiring of current or former public officials in connection with matters they have dealt with is subject to prior approval of Legal and HR, as the HR Security Policy sets out.

7.7 Social media and public speaking

• Personnel who comment on policy in public or on social media in a personal capacity must make clear that the views are their own and must not disclose confidential information.
• Speaking at conferences on regulation requires approval from the policy owner at least [5 working days] before the event.

8. Recordkeeping and Reporting

• The engagement log, register of memberships, register of intermediaries and register of gifts and hospitality offered to public officials are kept by the policy owner.
• The policy owner must report to top management [every 6 months] and to the Board [every 12 months] on engagements, positions, memberships, intermediaries, spend, concerns raised and outcomes.
• Spend on advocacy, memberships and intermediaries must be coded separately by Finance so that it can be reported.
• Concerns about engagement conduct may be raised with the policy owner, top management or through the whistleblowing channel, without fear of retaliation.

9. Compliance and Monitoring

• The policy owner checks the engagement log against calendars, expense claims and payments [quarterly] to find unlogged activity.
• Internal audit tests this policy as part of the audit plan [every 12 months], including a sample of engagements, intermediaries and payments.
• Personnel confirm annually that they have followed the policy, and spokespersons confirm that the log is complete.

10. Policy Availability

This policy is available to all personnel on the intranet and is communicated on joining and when it changes. A statement of the Organisation's approach to public policy engagement is available to the public on request or on the website.

11. Records and Evidence

Annexure A: Engagement plan and approval form

Annexure B: Engagement log

Annexure C: Register of industry memberships

12. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

13. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

14. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Information Security Policy
• HR Security Policy
• Supplier Relationship Management Policy
• Risk Management Policy
• Data Protection and Privacy Policy
• Internal and External Issues and Interested Parties