INFORMATION SECURITY POLICYAllkem Limited (Allkem or Company) is committed to pursuing high standards in relation to information security
where information, in all its forms, is considered a valuable asset which deserves to be managed and protected.
For this reason, the Board of Allkem has approved this Information Security Policy (Policy) with mandatory
application throughout Allkem and its subsidiaries. This Policy applies to:•Allkem and each of its wholly owned subsidiaries in the Allkem Group of companies;•All employees, directors, contractors, consultants, temporary, and other workers within the Allkem Groupfor those operations where we have management control (together, the “Employees”);•

Our suppliers and service providers, who through obligations in their supply arrangements, commit tomeeting the commitments and objectives set out in this Policy; and•Our Joint Venture partners and Joint Venture operations – in relation to which Allkem is committed tocooperating with and exploring opportunities to adopt the commitments in this Policy.

This Policy is aligned with both the ISO/IEC 27001 and the COBIT 5.0 standards. In line with these standards,
Allkem will strive to:•promote measures that protect the confidentiality of the Company’s information, preventing Employees,individuals, entities, or processes that do not have the proper authorisation from accessing it.

•implement actions which protect the information from unauthorised modifications, manipulations, orreproductions.

•maintain the availability of information and critical services, so that authorised users can access themwhenever needed.

•certify the authenticity of the information, striving to ensure that it comes from a reliable source andensuring its flow from sender to receiver.

•comply with all applicable legal requirements, including those under the Australian Privacy Act 1988 (Cth)the Argentinian 25.326 Personal Data Protection law, the Canadian Personal Information Protection andElectronic Documents Act (S.C. 2000, c. 5) and any other jurisdictions where the Company operates or storesits data.

•define and assign the functions and responsibilities of all Allkem Employees and third-party service
providers in relation to compliance with this Policy.

•implement data categorisation (based on its relevance to the Company) to establish protection levels andassign physical and digital controls to them - as required in terms of security, accessibility, maintenance,storage, retention, and destruction.

•deploy Information Security training and education (including in relation to this Policy) to all Employees ofthe Company.

•identify and implement detection, prevention and response tools and controls for the protection of theCompany’s data and information assets against cyber-risks.

•

implement segregation of duties and isolate the environment of development, test, and production toprotect data against unauthorised access and disclosure.

•specify the system development and maintenance controls based on good market practices.

To fulfil the aims and objectives of this Policy, the Company’s Information Security Committee will aim to:•regularly review the Policy and make recommendations to the Board in relation to any modifications orreplacements to it;•implement systems and controls to minimise the potential risks in relation to information security;•review and monitor any possible incidents or threats in relation to information security and report theseappropriately;

INFORMATION SECURITY POLICY1

•

make recommendations in relation to and carry out any approved improvement initiatives in relation toinformation security.

•provide guidance and technical expertise to the Company to protect its information, based on the principles
outlined above.

Allkem has also developed and implemented a Cybersecurity Strategy, based on appropriate information
security standards and good market practice, with the objective of mitigating any potential cyber risks orinformation security incidents.
The Board of Directors of Allkem Limited commits to ensuring the availability of resources (as necessary) forimplementing this policy. This policy has been approved by the Board of Directors of Allkem Limited.

Martin Perez de Solay
Managing Director / Chief Executive Officer
Allkem Limited
June 2022

INFORMATION SECURITY POLICY2