How Hilton protects personal information: reasonable measures and a dedicated security team
Hilton says it takes reasonable measures to protect personal information from unauthorized access, disclosure, alteration or destruction, and to keep it accurate and up to date as appropriate. It employs a dedicated global information security team responsible for managing the security programme, which monitors systems for potential intrusions, responds to potential incidents, supports property-level information security, regularly reviews and updates the security controls used to protect data, and provides training on the programme. The measures are described as reasonable measures and the team as a robust team; the statement gives no certification level or incident record.
Supporting quotations
6. How We Protect Personal Information
We take reasonable measures to: (i) protect personal information from unauthorized access, disclosure, alteration, or destruction, and (ii) keep personal information accurate and up-to-date as appropriate.
Hilton employs a robust team of dedicated information security professionals who are responsible for managing Hilton’s security program.
This team is responsible for, among other things, monitoring our systems for potential intrusions, responding to potential incidents, supporting property-level information security, regularly reviewing and updating the security controls Hilton uses to protect data, and providing training on Hilton’s information security program.
Qualifications & exceptions
The commitment is to 'reasonable measures' and to accuracy 'as appropriate', not to an absolute guarantee.
The security programme description lists activities; it does not state how effective they are.
Security & Safeguards · Company commitment
Security controls, third-party confidentiality, no card details by message, and incident notification
Hilton says it implements risk-based security controls, including encryption and ongoing employee training, aligned with industry standards, and maintains a payment card industry (PCI) compliance programme and an information technology compliance programme. That programme generates audit reports on the adequacy and effectiveness of Hilton's technology internal controls, including a PCI Attestation of Compliance signed by an external PCI Qualified Security Assessor and an SSAE16/SOC1 report on technology general controls supporting certain accounting and financial reporting. Hilton requires third parties it shares personal information with to exercise reasonable efforts to maintain confidentiality, says it will never ask a person to send confidential personal information or payment card information by email or text message, and says that in the event of a security incident it will notify regulators and/or affected individuals in a timely manner as required by applicable laws and regulations.
Supporting quotations
Hilton implements risk-based security controls, including encryption and ongoing employee training, aligned with industry standards.
Hilton maintains a payment card industry (“PCI”) compliance program and an Information Technology compliance program.
This compliance program generates audit reports concerning the adequacy and effectiveness of Hilton’s Technology internal controls, including a PCI Attestation of Compliance signed by an external PCI Qualified Security Assessor and a SSAE16/SOC1 report addressing the Technology general controls over systems that support certain accounting and financial reporting.
We require third parties with whom we share personal information to exercise reasonable efforts to maintain the confidentiality of personal information.
We will never ask you to send us confidential personal information or payment card information via email or text message.
In the event of a security incident, Hilton will notify regulators and/or affected individuals in a timely manner as required by applicable laws and regulations.
Qualifications & exceptions
The controls are described as risk-based and aligned with industry standards.
The obligation imposed on third parties is to exercise reasonable efforts, not a stated guarantee of confidentiality.
Incident notification is tied to what applicable laws and regulations require, and 'timely' is not defined here.
Security & Safeguards · Company commitment
China: reasonable steps to protect personal information, as in the main body
The China appendix says Hilton takes reasonable steps to protect personal information from unauthorized access, disclosure, alteration or destruction, and to keep personal information appropriately accurate and current by using appropriate technical and organizational measures, and refers the reader to the How We Protect Personal Information section of the main body for more information.
Supporting quotations
7. How We Protect Personal Information
We take reasonable steps to: (i) protect personal information from unauthorized access, disclosure, alteration, or destruction, and (ii) keep personal information appropriately accurate and current by using appropriate technical and organizational measures.
Qualifications & exceptions
The commitment is to reasonable steps and appropriate technical and organizational measures.
The detail is in the main body rather than in the appendix.
Security & Safeguards · Company commitment
Monaco: notification and mitigation for a high-risk personal data breach
The Monaco appendix states that in case of a breach of personal data liable to pose a high risk to the person's rights and freedoms, Hilton shall inform the person as soon as possible and take all necessary measures to limit the risks related to the breach. It adds that whether the data is processed by Hilton or by its subcontractors and partners, the same security and privacy requirements apply.
Supporting quotations
3. Personal Data Security
In case of breach of your personal data liable to pose a high risk to your rights and freedoms, Hilton shall inform you as soon as possible and take all necessary measures to limit the risks related to this breach.
Whether your data is processed by Hilton or by its subcontractors and partners, the same security and privacy requirements apply to your personal data.
Qualifications & exceptions
The notification duty is tied to a breach liable to pose a high risk.
The same requirements are stated to apply to subcontractors and partners.
Security & Safeguards · Company commitment
Nigeria: reasonable steps to protect personal information, as in the main body
The Nigeria appendix states that Hilton takes reasonable steps to protect personal information from unauthorized access, disclosure, alteration or destruction, and to keep it appropriately accurate and current by using appropriate technical and organizational measures, referring to the How We Protect Personal Information section of the main body for more information.
Supporting quotations
4. How We Protect Your Personal Data
We take reasonable steps to: (i) protect personal information from unauthorized access, disclosure, alteration, or destruction, and (ii) keep personal information appropriately accurate and current by using appropriate technical and organizational measures.
Qualifications & exceptions
The detail is in the main body rather than in the appendix.
Security & Safeguards · Company commitment
Korea: reasonable steps to protect personal information, with the detail in the main body
The Korea appendix states that Hilton takes reasonable steps to protect personal information from unauthorized access, disclosure, alteration or destruction, and to keep it appropriately accurate and current by using appropriate technical and organizational measures, and directs the reader to the How We Protect Information section of the main body for additional details.
Supporting quotations
5. How We Protect Personal Information
We take reasonable steps to: (i) protect personal information from unauthorized access, disclosure, alteration, or destruction, and (ii) keep personal information appropriately accurate and current by using appropriate technical and organizational measures.
For additional details, please refer to the How We Protect Information section in the main body of this Statement.
Qualifications & exceptions
The detail is in the main body rather than in the appendix.