John Botha | COO | Global Business Solutions | mail me |
The Protection of Personal Information Act (POPI) is a crucial statute for organisations to get right. Not only because the 4th Industrial Revolution (4IR) is all about data and information but also because a breach of the POPI Act could result in imprisonment and fines.
It is the implementation of POPI that has many firms paralysed. However, this elephant must be eaten piece by piece and there is still time to comply by 30 June 2021.
Herewith a simple checklist that can be used:
- Written appointment of the Information Officer (IO) unless it is the Chief Executive in which case the appointment is automatic by law. Also appoint Deputy IOs if you believe this is necessary.
- Register the IO and DIO on the Information Regulator (IR) website and get your certificate of registration.
- Draft/update your POPI policy and practice manual.
- Draft an Incident Response Plan (i.e. a plan that explains what happens if the Personal Information (PI) under your or your ‘operator’s’ management and control is compromised).
- Draft/update your Privacy Policy for your website and business.
- Set up training sessions for your managers and staff who process PI and at the training ensure that:
- you have an attendance register.
- you have them sign the Annexure to the Employment Contract on POPI, and
- you hand out the POPI policy for their reference.
- Ensure your s51 PAIA manual is crafted and posted on your website.
- Identify all ‘operators’ as defined and ensure you enter into/obtain their contractual terms relating to POPI. Remember at least two matters must be addressed in that POPI contract with the ‘operator’:
- the operator must warrant that it complies with POPI and related PI statute, and
- that it will immediately advise you if the information you provided to the operator is compromised whilst in the hands of the operator.
This is because you will have to report the data breach to the regulator and contact the impacted data subjects.
- Data subject participation: Remember that all previous, current and past suppliers, employees and clients/ customers have the right under POPI to participate in their data which basically means they must have a simple and effective channel (recorded by the employer) that allows them to contact the IO/ DIO to request update, deletion, destruction, objection, complains, opting in (for e-marketing purposes).
Remember that from 1 July 2021 all new data subjects must give their permission for e-direct marketing before you send out marketing collateral.
- I highly recommend you list all systems, tech and programmes you use and have your IT department give written assurance that all is in order – firewalls, anti-virus, user access, back-ups, encryption, etc.
- Finally, an impact assessment matrix that requires each function to identify processes that they engage in that process PI and then to ensure the systems and staff conduct is up to scratch. If any PI is sent outside of SA borders, Special PI is dealt with or under 18-year data subjects that the necessary POPI provisions are complied with.