10 Owners are responsible for defining and periodically reviewing the classification of data assets and information held in their services and to determine how this information is handled in accordance with WHO policies.
20 Users are responsible for ensuring that data assets and information they are working with are adequately handled and protected according to its security classification.
30 All alleged violations of this policy should be reported to Internal Oversight Services.
40 For individuals or entities affiliated with WHO, failure to comply with this policy may result in various measures being taken against the individual or entity concerned, including an investigation, ongoing compliance measures, removal of access or, for serious cases, termination of contract or initiation of legal proceedings. For staff members of WHO, such failure may also result in disciplinary proceedings being initiated following an investigation, which could ultimately result in a disciplinary measure up to and including dismissal in accordance with the WHO Staff Regulations and Rules.
