POPI Act compliance - a top priority for 2021

The Protection of Personal Information Act (POPIA) is in effect, and businesses need to make compliance a top priority for 2021. 

Businesses are required to exercise a duty of care in respect of the personal information of other people and their own companies in terms of the Companies Act to avoid significant civil claims.

History of POPIA

POPIA is not unique to South African law. Other countries have the same type of legislation to safeguard the personal information of their "data subjects". 

The general consensus appears to be that POPIA is well thought through as it was benchmarked with the "best of" other similar international laws, learning from their deficiencies and blunders.

• The Information Regulator will start enforcing POPIA, and businesses can face weighty penalties if found guilty of non-compliance. 
• If your business processes personal information, you will most likely be impacted by POPIA, in particular those businesses operating within the Marketing, Healthcare and Financial Services sectors.

Most companies made parallel changes with the inception of the Consumer Protection Act (CPA) way back in 2008. With POPIA demanding the same level of commitment and consideration from company executives, it is critical to steer organisations in the right direction by preparing for and accommodating new data legislation. Realistically, South African businesses should already have started their POPIA implementation processes in order to ensure compliance.

What is the purpose of POPIA?

POPIA, in simple terms, sets conditions for how you can legally process personal information. It fundamentally views personal information as being a valuable possession and consequently aims to give you, as the possessor of your personal information, certain rights to protection. Its main purpose is to ensure that when storing, processing, gathering, and distributing another entity's personal information, all South African entities can be held accountable should they compromise or exploit personal information in any form.

• You should know that this right to protection of "personal information" is relevant to individuals and any legal entity such as companies, communities and any other legally acknowledged organisations. These entities are considered to be "data subjects" and have the same right to protection of their information.
• This simply means that while you as a consumer have rights and protection, you and your company are considered "responsible parties" and have the same responsibility to protect other parties and their personal information. For companies, this would include protecting information about your employees, vendors, business partners, service providers, etc. 

We live in an information era and, along with this evolution, comes the obligation of every individual to safeguard their own information. For example, you cannot accuse someone else of sharing your personal information when you widely publish exactly the same information on public domains or directories such as Facebook or LinkedIn. With advanced technology it is extremely easy to gain access to and collect and process high volumes in a very short period of time. It is important to note is that this information can be used for additional processing or can even be sold. Imagine the permanent damage that this can cause companies and private individuals!

The POPIA challenge for business owners

Integrating POPIA into the daily operations of a business will definitely require a substantial amount of time and determination, for instance updating all business practices; training and apprising employees; and updating technology solutions.  POPIA may seem to be subject to manipulation and challenging to understand when you apply it to your specific circumstances as it deals with intangible concepts. Where should a business owner start?

Five Important points to consider when processing personal information:

• Record your data and personal information – know where, what type of and by whom all personal information is being processed (storing, controlling and deploying information);
• Prepare for dealing with numerous regulators and authorities – the Information Regulator, SARS and Financial Services Board, etc.;
• Evaluate all service agreements relating to data processing – update contracts accordingly and keep them proximate – clear roles should be defined for everyone in the processing chain;
• Ensure that all fundamental responsibilities towards customers are in place and executed – interaction with customers should be professional and satisfying;
• Prepare for executing an all-inclusive POPIA assessment by seeking practical legal advice and guidance – preferably consult with professionals and spend adequate time and money to ensure you are POPIA compliant.

Fortunately, the implementation of POPIA in your business does not have to be a time-consuming or demanding task if you have implemented an Protection of Personal Information Assessment and Report along with a Protection of Personal Information Privacy Policy.  By implementing POPIA, you have an opportunity to evaluate and streamline your business operations, policies and processes based on comprehensive business practices by embracing applicable and cost-effective technological solutions.

SERR Synergy assists businesses and organisations to comply fully with processes and procedures as required by POPIA.

About the Author: Retha van Zyl completed her BCom Hons (Economics and Risk Management) studies at the North West University. She joined our team in January 2016 and currently holds the title ‘Senior Information Compliance Advisor’. She specialises in POPI and PAIA compliance, which includes compiling and submitting PAIA Manuals to the Human Rights Commission. She also compiles the Data and Information Protection Report to identify risks associated with information security and drafts Information Security policies for procedural compliance in each department within an organisation. 

*Please note that the original article was published in 2017 – this is an updated version for 2021–- Checklist when preparing for POPI and Data laws.