The focus, for many, has been the security implications of ensuring that personal data is not accessed without authorisation. The PoPI Act, however, goes much further than simply defining how personal data may be captured and used. PoPIA governs the end-to-end life cycle of personal data within any company, irrespective of the size. PoPIA Compliance is built upon sound data management principles and enterprise collaboration.
Build Privacy into Your Governance Program
Data Management Foundations for PoPIA Compliance
Data management principles are integral to the Protection of Personal Information Act (PoPIA) and are directly incorporated into the provisions of the Act. PoPIA has been designed to ensure data privacy by regulating the collection, use, storage, and dissemination of personal information by all entities in South Africa.
To ensure compliance with PoPIA, Masterdata helps organisations adopt comprehensive data management practices that align with the principles set out in the Act. These principles include:
-
Accountability: This principle requires organisations to take responsibility for the personal information they process and ensure that they comply with the provisions of the Act.
-
Responsible party to ensure conditions for lawful processing
-
Processing Limitation
-
Lawfulness of processing
-
-
Lawful processing: This principle requires organisations to collect and process personal information in a lawful and fair manner and for a specific and explicit purpose.
-
Collection directly from the data subject
-
Consent, justification and objection
-
-
Limitation of processing/ Minimality: This principle requires organisations to limit the collection and processing of personal information to what is necessary to achieve the stated purpose.
-
Purpose specification: This principle requires organisations to explicitly define the purpose for which personal information is being collected and processed and to ensure that the information is only used for that purpose.
-
Collection for a specific purpose
-
Further processing to be compatible with the purpose of collection
-
Retention and restriction of records
-
-
Data quality: This principle requires organisations to ensure that the personal information they collect and process is accurate, complete, and up-to-date.
-
Openness: This principle requires organisations to be transparent about their data processing practices and to provide data subjects with access to their personal information.
-
Documentation
-
Notification to the data subject when collecting personal information
-
-
Security safeguards: This principle requires organisations to put in place appropriate technical and organisational measures to safeguard personal information against loss, damage, or unauthorised access.
-
Security measures on integrity and confidentiality of personal information
-
Information processed by operator or person acting with authority
-
Security measures regarding the information processed by the operator
-
Notification of security compromise
-
-
Data subject participation: This principle requires organisations to provide data subjects with the opportunity to access and correct their personal information, and to allow them to object to the processing of their information in certain circumstances.
-
Access to personal information
-
Correction of personal information
-
Manner of access
-
PoPIA provides detailed guidelines on how organisations should apply these principles in practice. For example, organisations must appoint an Information Officer who is responsible for ensuring that the organisation complies with PoPIA. Organisations must also develop policies and procedures that address each of the principles outlined above.
In addition, organisations must ensure that they obtain the consent of the data subject before collecting and processing their personal information, and that they provide data subjects with access to their personal information upon request. Organisations must also take steps to protect any special personal information they collect and process, such as health or financial information.
Overall, the data management principles embedded in PoPIA help to ensure that organisations in South Africa collect and process personal information in a responsible, transparent, and secure manner, while also protecting the rights of data subjects.
Data Governance
One of the key elements of POPIA is the requirement for lawful processing of personal information.
This means that organisations must have a valid reason for collecting, using, and storing personal information. This must be explicitly defined and communicated to data subjects, and their consent must be obtained before any processing takes place.
Data Governance is the data management discipline that identifies and enrols stakeholders to define, document, communicate and enforce acceptable use policies for personal information within your organisation. Data policies, responsibilities and processes must be in place to comply with various conditions of the PoPI Act, as summarised below
- Condition 1 Accountability
- Condition 2: Processing limitation
- Data collection policies
- Condition 3 & 4: Valid Purpose
- Condition 3: Retention policies
- Condition 5: Data quality standards and rules
- Condition 7: Security policies
- Breach management process
- Data sharing agreements
Data Quality
Additionally, organisations must ensure that personal information is accurate, complete, and up to date.
Data Quality is the discipline of ensuring that personal data used within your company is of an acceptable level of quality and measuring compliance with data governance policies in order to comply with POPIA condition 5.
- Condition 5: Data quality standards and rules
Master Data Management
Another important element of POPIA is the promotion of access to information. Data subjects have the right to access their personal information that is held by an organisation. They can also request that their personal information be corrected, deleted, or destroyed. However, organisations can only refuse access to information under certain circumstances, such as when it may harm the data subject or others, or when it is subject to legal privilege.
Master Data Management – ensure that you can provide an accurate indication of what data you are holding about each subject, irrespective of the channel they use to communicate with you, and that you are able to comply with customer requests to opt-out of marketing communications, as required by the below PoPI conditions
- Condition 5: Data Quality standards and rules
- Condition 6: Data subject notifications
- Condition 8: Subject access
Data Transparency
To ensure compliance with POPIA, organisations must appoint an information officer.
The information officer is responsible for ensuring that the organisation complies with POPIA, and for dealing with any requests from data subjects. Additionally, organisations must have a code of conduct that outlines how personal information will be processed, and how data subjects' rights will be protected.
Data transparency keeps the data subject informed about how their data is being used, and for what purpose, and is essential for maintaining trust with customers.
Metadata Management
Special personal information, such as information relating to a person's health, race, religion, or sexual orientation, is subject to additional protection under POPIA. Organisations must obtain explicit consent from data subjects before processing such information, and must take additional measures to protect this information.
Metadata Management - understand where sensitive data is stored, and how it moves through the organisation and classify and tag personal information to ensure data privacy
- Process register
- Personal data inventory
- Data quality metrics
Data Security
In the context of electronic communications, POPIA requires that organisations take reasonable steps to ensure the security of personal information that is being transmitted over a network. This includes ensuring that the information is encrypted, and that access to the information is restricted to those who are authorised to access it.
Data Security – identify and control where personal data is held, who has access to it and whether this access is appropriate.
- Condition 3 & 4: Valid Purpose
- Role-based security at the column level
- Condition 7: Security policies
- Section 19, 20, 21: Dynamic encryption and masking at rest and in movement
- Section 20, 21: No sharing of keys with 3rd parties including cloud providers
- Section 22: Real-time monitoring and behaviour-based alerts
What is Data Privacy?
Data privacy can be defined as the right (of individuals and legal entities) to have control over how their personal data is collected and used. It is the branch of data security concerned with the proper handling of data.
The Act covers various aspects of personal information, including what it is, how it can be used, and how it must be protected. PoPIA defines personal information as any data that may identify a natural, legal or juristic person, or distinguish that person from another. This includes aspects as diverse as religion, medical history, bio-metrics, online screen names, or even opinions of, or about, a third party.
Unlike GDPR, the PoPI Act applies to the data of any legal entity – from a natural person to a company, trust or non-profit institution.
As such PoPIA extends beyond customer data and governs the use of other party's data, such as data related to employees, suppliers and partners.
Have you achieved PoPIA Compliance?
Data Privacy: A Strategic Reponse to PoPIA Compliance
In addition to PoPIA, South Africa also has the Promotion of Access to Information Act (PAIA). PAIA gives individuals the right to access information that is held by public and private bodies. This includes information that is not covered by the PoPI Act, such as information relating to public safety and the environment.
Finally, it is important to note that the Information Regulator is responsible for enforcing PoPIA.
The regulator has the power to investigate non-compliance, issue fines, and refer cases for criminal prosecution. As such, organisations must take compliance with PoPIA seriously and must ensure that they have adequate measures in place to protect personal information.
In summary, compliance with PoPIA requires an enterprise approach, with a focus on data management principles and collaboration. Our PoPIA accelerator simplifies compliance by facilitating a top-down, iterative approach leveraging prebuilt components.
Organisations must ensure that they have a valid reason for processing personal information, that they obtain explicit consent from data subjects, and that they take measures to protect personal information. Additionally, organisations must appoint an information officer, have a code of conduct, and take reasonable steps to ensure the security of personal information
With strained budgets, identifying critical data tasks across an organization is growing ever more difficult with options including data security, data compliance, data privacy and data governance.
Executing these tasks in a silo or as stand-alone technologies won’t drive success.
Learn how the cause-and-effect connections between these activities can drive your company toward data success in this research report from Aberdeen
Why do we have PoPIA?
The Constitutional Right to Privacy
The Protection of Personal Information Act ( PoPIA or PoPI Act) was signed into South African law in late 2013 and came into full effect in July 2021. The main objective of POPIA is to protect the personal information of individuals from being unlawfully accessed, used, and processed by businesses and other organizations.
PoPIA is based on the constitutional right to privacy, as enshrined in the South African Constitution. The right to privacy is a fundamental human right that is recognized by many international human rights instruments, including the Universal Declaration of Human Rights and the International Covenant on Civil and Political Rights. The Act also drew heavily from international privacy regulations, such as Europe's Global Data Protection Regulation (GDPR), to ensure broad compliance with international best practices.
Prior to PoPIA, South Africa did not have comprehensive data protection legislation in place. There were some sector-specific laws and regulations that provided limited protection for personal information, but there was no overarching legislation that applied to all sectors and industries.
This left individuals vulnerable to the misuse of their personal information, particularly in the digital age where personal information is constantly being collected and processed.
PoPIA was therefore enacted to provide a framework for the lawful processing of personal information in South Africa.
Aims of PoPIA
The PoPI Act aims to strike a balance between protecting individuals' privacy rights and allowing organizations to collect and process personal information for legitimate purposes, such as for the promotion of access to information or for electronic communications.
In addition, PoPIA is designed to promote the responsible use of personal information by organizations. It requires organizations to implement appropriate measures to safeguard personal information against loss, damage, or unauthorized access. Organizations are also required to have in place a code of conduct that governs the processing of personal information.
PoPIA also provides for the appointment of an Information Officer who is responsible for ensuring that an organization complies with the requirements of the Act. The Information Officer must ensure that the organization implements appropriate measures to protect personal information and that it complies with the conditions for the lawful processing of personal information.
Overall, the Protection of Personal Information Act is a necessary and important piece of legislation that provides a legal framework for the protection of personal information in South Africa. It provides individuals with greater control over their personal information and gives them the right to access and correct the personal information held by organizations.
PoPIA also promotes responsible and lawful processing of personal information by organizations, which helps to build trust and confidence in the digital economy.
PoPIA Compliance
The focus, for many, has been the security implications of ensuring that personal data is not accessed without authorisation. The PoPI Act, however, goes much further than simply defining how personal data may be captured and used. PoPIA governs the end-to-end life cycle of personal data within any company, irrespective of the size.
Got a Question? 
