The Protection of Personal Information Act (POPIA) will be taking full effect in South Africa on 1 July 2021. It’s important to ensure that your business is fully compliant. Failure to do so comes with dire consequences – including hefty fines. POPIA can be seen as an opportunity to identify and manage information better within your organisation, which also means improving business processes.

We’ve put together 3 Easy Steps that you can take to jumpstart your compliance.

Step 1: Business Privacy Impact Assessment.

In the POPI Act, The 7th Condition – “Security Safeguards” – states that organisations are to take “appropriate and reasonable measures” to safeguard personal information. Within each business unit, business owners should ensure that all employees are properly informed through awareness campaigns. Then, self-assessments and audits should begin throughout the organisation.

It is important to gain a thorough understanding of what information is collected, how it is collected, by whom it is collected, what it is used for, how it is stored and processed, how it is retained and whether it was collected with the appropriate consent. Self-audits allow for a clearer understanding of how all data is being processed in the company, and where the gaps and risks are that need to be addressed.

Step 2: Appoint or Reassess the Role of the Information Officer.

The POPIA regulations advise that the role of an information officer and their duties have been extended and now include some responsibilities that are compulsory. The automatic information officer of any private body is its head, which is usually the CEO, unless it has been delegated to an appointed staff member.

To achieve compliance, it is necessary to appoint an information officer if the organisation does not yet have one, or to reassess the role of the existing information officer and ensure that it is in line with the requirements set out in the POPI Act.

Step 3: Compliance Implementation

In order to take the necessary actions to implement the POPI Act, it is useful to develop a compliance framework. Identifying the processes and policies that need to be put in place can be monitored and maintained by following your framework. The final step to achieve compliance is proper implementation of the new procedures through in-depth training, awareness campaigns and audits.

Learn How to Comply with the POPI Act

Stricter data privacy legislation requires that organisations implement judacious data processing standards to ensure the privacy and security of personal information. Failure to comply with the POPI Act could leave you with a fine of up to R10 million. Plus, if your clients are impacted by a data breach, POPIA empowers them to take civil action for damages.

The new requirements of the POPI Act can seem tedious, but there are resources to assist in the training and implementation of POPIA, privacy and cybersecurity.

Click here to download a free copy of CDT’s eBook to learn more about POPIA, Your Business and Your Employees.

If you want to kickstart your POPIA implementation, contact CDT for assisted implementation services. Click here for more information.