more info
POPI Act Non-Compliance?
What happens if you are not Popi compliant?
If you fail to comply with the POPI Act, whether intentional or accidental, you can be liable for an administrative fine of up to R10 million or 10 years in jail.
If your clients are impacted by a data breach, POPIA even empowers them to take civil action for damages and your reputation may be harmed.
Why should you comply with POPI Act?
The POPI Act requires businesses to regulate how information is organised, stored, secured, and discarded. This ensures that the business can maintain the integrity and confidentiality of its clients’ and employees’ personal information by preventing loss, damage, and unauthorised access to the personal data.
What happens if you are not Popi compliant?
Put simply, you will not be able to work with other companies if your company does not respect personal information. Your reputation is harmed. A data breach almost always results in reputational harm. Employers should comply relevant requirements of POPIA. By failing to do so, employers are at the risk of imprisonment of up to 10 years and/ or fines of up to R10 million or being liable for damages.
What is Popia compliance?
Compliance to the Protection of Personal Information Act (POPIA), also known as the POPI Act, will be mandatory for most organisations in South Africa. As the Information Regulator develops the POPI Regulations further, so the dates and requirments will become clearer.
Who has to comply with Popia?
The Act applies to any person or organisation who keeps any type of records relating to the personal information of anyone, unless those records are subject to other legislation which protects such information more stringently.
How do you comply with POPI Act?
Five easy steps to POPI compliance
- Appoint or reassess the role of the information officer.
- Create awareness.
- Personal information impact assessment, like the POPIA Website Assessment Tool.
- Develop a compliance framework, which can include processes and policies. …
- Get quotes if needed and run implementation strategy.
What is the purpose of Popia?
The Protection of Personal Information Act 4 of 2013 (POPIA) is the comprehensive data protection legislation enacted in South Africa. POPIA aims to give effect to the constitutional right to privacy, whilst balancing this against competing rights and interests, particularly the right of access to information.
What is the difference between Popi and Popia?
POPI is short for the protection of personal information (a topic) as opposed to POPIA which is short for the Protection of Personal Information Act (the Act). … They are both topics which refer to the protection of personal information or data, and can be used interchangeably.
Is Popi Act in effect?
After 8 years, the POPI Act is fully enacted on 1 July 2021
Who is the information regulator Popi?
The Information Regulator is a new regulator that has been created by the Protection of Personal Information Act (POPI Act). POPI gives the Information Regulator teeth – it has extensive powers to investigate and fine responsible parties.
Why was the Protection of Personal Information Act 2013 introduced?
To promote the protection of personal information processed by public and private bodies; to introduce certain conditions so as to establish minimum requirements for the processing of personal information; to provide for the establishment of an Information Regulator to exercise certain powers and to perform certain tasks.
What are the six lawful basis for processing?
The law provides six legal bases for processing: consent, performance of a contract, a legitimate interest, a vital interest, a legal requirement, and a public interest. First, most organizations ask if they have to have consent to process data.
What are the 8 principles of Popia?
Principle 1: Accountability. Principle 2: Processing Limitation. Principle 3: Purpose Specification. Principle 4: Further Processing Limitation
There are 8 to 10 things to consider with getting the POPIA Compliancy in place.
Almost all organisations are faced with the challenge of achieving and maintaining compliance with the Protection of Personal Information Act No. 4 of 2013 (POPI Act). This handy checklist provides a proven step-by-step forty-action-point approach to compliance.
1. Formalise your POPI Act compliance project
- Identify your relevant stakeholders
- Identify your project sponsor
- Identify your project manager
- Set high level scope, timescale, budget
2. Appoint an Information Officer
- Ensure alignment between your Promotion of Access to Information Act (PAIA) and POPI Information Officer (IO)
- Decide whether the CEO can fulfill the IO function or needs a Deputy/Deputies (DIO)
- Agree IO/DIO roles and responsibilities
- Complete the formal appointment process
3. Perform a gap analysis versus the POPI Act
- Set interim and final targets for compliance with the POPI Act. This does not mean slavishly shooting for 100% regardless of costs and benefits!
- Engage with stakeholders in the assessment
- Use an evidence-based approach
- Use the assessments for ongoing compliance monitoring
4. Analyse what and how Personal Information is processed
- Use a broad definition of record types as per the POPI Act (e.g. CCTV, biometric)
- Look at various aspects as required by the POPI Act (including consent, purpose, source, sharing, destruction)
- Consider user rights and their management
- Think broadly in terms of the types of devices where data is stored – and represents a security compromise risk
5. Implement POPI Act compliance policies
- Review existing relevant policies
- Ensure your policies are reasonable and appropriate
- Make sure your policies are enforceable
- Design your Privacy Notices for diverse stakeholder groups
6. Review your web sites
- Run the POPIA Website Assessment Tool
- Get a quote to get your website POPIA ready.
- Implement POPIA compliancy strategy & tools on your website.
- Use the opportunity to implement “best practice” such as Cookie notifications
- Develop and implement your remediation plan
7. Update / create your PAIA manual
- Confirm your organisation needs a Promotion of Access to Information Act (PAIA) manual and by when
- Confirm whether you are a Public or Private Body as per the PAIA
- Review the proposed contents of your manual
- Ensure your PAIA manual follows the prescribed layout and includes the necessary details
8. Implement POPI compliant PI management processes
- Look at the PI lifecycle: including acquisition, processing, retention, and destruction practices
- Develop reasonable and appropriate measures to ensure ongoing compliance
- These could include self-assessments, health-checks, formal audits
- Develop your dashboard for compliance
9. Train stakeholders about their roles in POPI Act compliance
- Design training according to their needs
- Ensure you treat user education not as a once-off series of activities but part of an ongoing commitment
- Leverage diverse training methods, including self-study, online, classroom, audio and video
- Look to special needs such as the IO/DIO roles
10. Make POPI Act compliance “Business-As-Usual”
- Recognise that POPI Act compliance will be the “new normal” and work that way
- Build compliance into your products, services and processes – adopt “Privacy By Design”
- Ensure ongoing monitoring of the data protection / POPI ecosystem – legislation, regulations, opportunities and threats
- Build POPI into your everyday operations – make POPI “Business-As-Usual”
Let’s Get Started
Ready To Comply? Let’s help you now!
[elfsight_cookie_consent id="1"] [elfsight_whatsapp_chat id="2"]