The Bribery Act 2010 comes into force today, replacing the UK’s patchwork of older anti-corruption laws.
Alongside offences of bribing, being bribed and bribing a foreign public official, section 7 creates a new corporate offence of failing to prevent bribery by an “associated person”, such as an employee, agent or contractor. The only defence is to show that the organisation had adequate procedures in place.
Why does this matter for information security?
- Bribery of insiders is a well-known route to data theft and unauthorised access.
- “Adequate procedures” depend on reliable records: gifts and hospitality registers, due diligence files and investigation evidence all need protecting.
- Ministry of Justice guidance sets six principles: proportionate procedures, top-level commitment, risk assessment, due diligence, communication and training, and monitoring and review. These map naturally onto an ISO/IEC 27001 style management system.
Now is a good time to review your supplier due diligence, whistleblowing channels and record-keeping controls.
Source: Bribery Act 2010 (legislation.gov.uk)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
