GCash has become the first Philippine fintech company to simultaneously achieve ISO certifications for information security management (ISO/IEC 27001) and privacy information management systems (ISO/IEC 27701).

These certifications followed an independent audit conducted by the British Standards Institution (BSI).

The certifications confirm that GCash’s information security and privacy management systems meet international standards and established best practices. This external validation is intended to foster transparency and build trust within the platform’s user base.

Pebbles Sy, GCash Chief Technology and Operations Officer, remarked on the achievement.

“These ISO certifications are external validations of our internal belief that we must always operate with the highest integrity and discipline by integrating security and privacy into every aspect of our operations and innovations,” said Pebbles. 

Ava Taniajura, BSI Country Managing Director, added that these certifications have equipped GCash with a significant advantage in safeguarding against potential threats.

The ISO/IEC 27001 certification specifically validates GCash’s systematic approach to managing sensitive information.

The ISO/IEC 27701 standard addresses the collection, storage, and processing of personal data. Its scope includes ensuring compliance with global and local privacy laws, like the Philippine Data Privacy Act and the EU’s General Data Protection Regulation (GDPR).

According to Atty. Rob Real, GCash Vice President and Group Data Protection Officer, their approach combines legal compliance with technology-enabled governance to stay ahead of increasingly complex threats.

Miguel Geronilla, GCash Chief Information Security Officer, highlighted the importance of proactive security measures.

“We have invested heavily in building a digital environment that prioritises safety. These certifications are not just milestones but also a reflection of our commitment to protecting the trust that our millions of users have placed in us,” Miguel stated.

The certification process involved aligning GCash’s policies, internal audits, employee training, and data processing protocols with globally recognised standards.

Featured image by sumitbiswas35244 on Freepik.