Data security and privacy

Being hyper-vigilant to keep data and systems secure

New cyberthreats continue to emerge, and the increase in remote work and online financial services creates additional data risks. We use data to help deliver on our Purpose. In doing so, we have an obligation to uphold Client and employee privacy, and to be transparent and accountable. We must work to find and prevent threats before they happen. These commitments require a constant evolution of best practices.

Our approach

Employee education and diligence are critical to our success in protecting our Clients’ data. Each year, employees complete mandatory security and privacy training courses. This training helps them understand their responsibilities, relevant rules and how to protect Client data and confidentiality.  

We also provide extra guidance and awareness-building programs to help employees deepen their knowledge. For example, our security team conducts interactive phishing simulations. These tests teach employees to find and avoid real-world cyber threats they may meet.

Cybersecurity is a growing concern for the public and a top priority for Sun Life. Organizations around the world are facing increasing attacks on their computer systems by sophisticated hacking groups.  

Our Senior Vice-President and Chief Information Security Officer (CISO) is accountable for providing global oversight over the implementation of Sun Life’s information security program and the Security Risk Policy. The CISO leads a global team of over 200 highly qualified individuals. Their global mandate includes the development, execution and operational management of Sun Life’s security strategy, risk assessments, security controls, monitoring, incident response and compliance. The CISO is also the chair of the global crisis management team and is responsible for reporting on technology risk. 

We continue to evolve our cyber defences to be effective against emerging threats. For example: 

  • Defence best practices: We align our security program to leading frameworks such as the Cybersecurity Framework of the National Institute of Standards and Technology. This framework outlines best practices to help organizations manage and lower their cybersecurity risks.  
  • Multiple control layers: We follow the three-lines-of-defence model to manage security risks (refer to Risk Management). We incorporate a “defence-in-depth” strategy and use multiple control layers to protect all data. These controls range from web firewalls, anti-malware software and encryption to intrusion monitoring and email threat protection.   
  • Security audits and testing: We regularly perform security audits, scanning and testing of Sun Life’s systems and practices involving Client data. Our security team assesses how effective our controls are and drives active improvements. We use security solutions that incorporate artificial intelligence and machine learning. These technologies help our security analysts assess threats and respond to cyberattacks. Every quarter, we report on cyber risk and cybersecurity to the Risk Committee of the Board of Directors. 
  • Cyber intelligence: We use cyber intelligence services to help us identify, assess and update our defences against the latest cyber threats. 

Our reputation depends on being responsible for data entrusted to us. Delivering on this duty involves:

  • Commitment to standards: Our global privacy program is part of Sun Life’s risk management framework across the company. The program includes robust processes and standards including our Global Privacy Statement. It explains how we collect and use the personal information of Clients, and other individuals who interact with us, in a lawful and respectful manner. Local privacy policies and statements provide further details on any individual rights related to accessing, correcting or obtaining a copy of their personal information.
  • Oversight and reporting: The Chief Privacy Officer oversees the global privacy program and sets direction for privacy compliance across the enterprise. Over 30 Privacy Officers across the enterprise help our businesses make privacy-related decisions. Our internal audit and compliance testing programs include privacy risk components. Every quarter, we report any significant privacy matters, including substantiated incidents from our Ethics Hotline, to Senior Management and the Board.
  • Privacy by design: We use privacy-by-design principles in our product development. We conduct Privacy Impact Assessments for new initiatives or material changes to existing processes that involve personal information. These assessments help us identify and manage privacy risks. We also include appropriate privacy and security clauses in contracts with third parties that handle personal information for us. 

Sun Life engages with industry groups and in public policy discussions to share intelligence and best practices for building stronger data protection and privacy programs. Examples include:  

  • Financial Services Information Sharing and Analysis Center  
  • Cyber Security Specialists Group organized by the Canadian Bankers Association  
  • Canadian Life and Health Insurance Association Information Security Sharing Group  
  • Canadian Cyber Threat Exchange  
  • Canadian Anonymization Network (CANON)
  • American Council of Life Insurers   
  • Life Insurance Council of New York, Inc.  
  • Information Accountability Foundation 
  • Canadian Marketing Association (CMA) Privacy and Data Committee 
  • Vector Institute for Artificial Intelligence
  • Philippine Life Insurance Association (PLIA)
  • Alliance for Privacy and Innovation in Canada

Managing data responsibly

Client data plays a big role in helping Sun Life deliver on our Purpose. Our Client Data Privacy Principles highlight this commitment and contribute to being a trusted and responsible business. They form the basis of our approach to managing Client data, including how we use data and who is accountable.

We use Client data to deliver on our Purpose

We do not sell Client data

We inform Clients about why we collect and use their data

2023 highlights

  • 98% of employees completed information security and privacy training1
  • Delivered 36 phishing simulation scenarios to employees, contractors and Canadian advisors2
  • 584 Privacy Impact Assessments conducted for new or modified products, services and programs

Learn more about our progress and performance in our 2023 Sustainability Report and ESG Performance Tables.

How Sun Life is leading the way in protecting privacy rights  

Before launching any product, service or initiative at Sun Life, we conduct a Privacy Impact Assessment (PIA) to proactively address any privacy risks. This helps us ensure Clients’ privacy rights are protected from the start. 

Learn more

Training completion rates are as at January 15 since annual training assigned during the reporting year may be completed after year-end. Refer to Sustainability Data Scope - Note 5.

Refer to Sustainability Data Scope - Note 5.

Refer to Sustainability Data Scope.