{"id":204445,"date":"2021-10-08T02:56:24","date_gmt":"2021-10-08T00:56:24","guid":{"rendered":"https:\/\/mypr.co.za\/?p=108350"},"modified":"2021-10-08T02:56:24","modified_gmt":"2021-10-08T00:56:24","slug":"how-to-navigate-through-the-maze-that-is-popia","status":"publish","type":"post","link":"https:\/\/www.myza.co.za\/press\/how-to-navigate-through-the-maze-that-is-popia\/","title":{"rendered":"How to navigate through the maze that is POPIA"},"content":{"rendered":"

<\/a><\/p>\n

With the newest data privacy law in South Africa, POPIA (Protection of Personal Information Act), now having taken effect, the race continues for companies to ensure that they adhere to this important piece of legislation.<\/p>\n

But what is POPIA? While many have heard about POPIA, also known as the POPI Act, some are unsure how it impacts their organisations\u2019 operations. The Protection of Personal Information Act, which is South Africa\u2019s equivalent of the EU\u2019s GDPR, sets out to protect its citizens\u2019 personal information from cybercrime and other misuses. It sets some conditions for organisations to responsibly and lawfully process specific data that can either identify a natural or juristic person \u2013 such as identity or telephone numbers \u2013 or contains confidential information, such as financial history or private emails.<\/p>\n

POPIA is important because it aims to protect people and organisations, called \u2018data subjects\u2019 in the Act, from harm, such as identity theft and fraud, by protecting their personal information. The risks of non-compliance include reputational damage, fines and imprisonment, and paying out damages claims to data subjects. The biggest risk, after reputational damage, is a fine for failing to protect account numbers.
The most significant impact is on organisations that process lots of personal information or highly sensitive personal information called special personal information, such as children\u2019s information and account numbers. The most affected industries are financial services, healthcare, and marketing.<\/p>\n

South Africa-based specialist IT Governance and Architectural services company, AVeS Cyber Security, says many companies are left feeling paralysed because they do not know how to approach or navigate the maze that is POPIA. Group CEO, Charl Ueckermann, says that while the process can be intimidating, it is vital for both consumers and businesses in the fight against cybercrime.<\/p>\n

\u2018The latest statistics indicate that impersonation fraud has increased by 337% in 2020 in South Africa. Fraudsters are good at impersonating consumers and representatives of the financial institutions that consumers belong to because they have access to huge amounts of data that provide the personal information needed to perpetrate this kind of fraud. The protection of personal information is becoming a major issue, and POPIA is a critical element of curbing these practices,\u2019 Ueckermann explains.<\/p>\n

But where to begin, and will every company and organisation be able to comply? Ueckermann says it\u2019s improbable that all companies would have complied by 1 July 2021; the goal should rather be to make a reasonable and ongoing effort.<\/p>\n

\u2018There is no such thing as being POPIA-compliant as POPIA-compliance is a journey rather than a destination. However, every organisation should make sure that they take reasonable precautions to collect, distribute, use, save and get rid of someone\u2019s data. If the Information Regulator ever approaches you with a data breach or POPIA-related complaint, you would need to show that you have taken all reasonable steps necessary to prevent the data breach from happening. It is, therefore, critical to get your ducks in a row proactively,\u2019 Ueckermann says.<\/p>\n

Ueckermann says companies such as AVeS Cyber Security specialises in assisting companies to become \u2018POPIA-Ready\u2019. He says the first step is to get a thorough assessment of a company\u2019s current status quo. The assessment deals with issues such as its current status of POPIA requirements, how it processes both personal information and special personal information, the existence of an Information Officer, prior authorisation of data processing, rights of data processing and transborder data storage.<\/p>\n

\u2018We have two assessment methods, the first being an online assessment, where clients can go through the questionnaire at their own time and pace. Once completed, they will receive a report that scores their current POPIA-readiness level and identify areas where they can improve. However, the report does not tell you what steps to take next or how to prioritise areas that need improvement, and this is where you need to call in the professionals. Secondly, there is also an onsite assessment that larger companies prefer and takes about a week to complete. This enables us to put a focused roadmap together that encompasses people, process and technology, getting them POPIA-ready in the shortest amount of time possible,\u2019 he says.<\/p>\n

Ueckermann says the self-assessments option costs R6999 (excl VAT), while an onsite assessment ranges from about R65 000. He says the implementation of all the steps to become POPIA-ready can take between 4 \u2013 12 months.<\/p>\n

\u2018There is no quick fix or shortcut to becoming POPIA-ready. You need to put in the work to avoid putting yourself and your organisation at risk of non-compliance.\u2019<\/p>\n

Ueckermann says the following checklist can come in handy to gauge whether you are POPIA-ready and where you would need help:
\u2022 Appoint an Information Officer in writing, unless this person is the CEO, in which case the appointment is automatic.
\u2022 Register the Information Officer on the Information Regulator\u2019s website and get your certificate of registration.
\u2022 Draft or update your POPIA policy and practice manual.
\u2022 Draft an incident response plan that will set out the procedure to follow when personal information under your or your operator\u2019s management and control is compromised.
\u2022 Draft or update your privacy policy for your business, including your website.
\u2022 Set up training sessions for managers and staff who process PI and have them sign an attendance register.
\u2022 Ensure your section 51 PAIA manual is available on your website.
\u2022 Identify all operators as defined in the Act and ensure you enter into or obtain their contractual terms regarding POPIA.
\u2022 Ensure that you make provision for data subject participation. Remember that POPIA gives all previous, current and past suppliers, employees and clients or customers the right to participate in their data.
\u2022 List all systems, technologies and programmes you use and have your IT department give written assurance that all is in order, such as firewalls, anti-virus programmes, user access, back-ups and encryption.
\u2022 Design an impact assessment matrix that requires each function to identify the processes they follow that include personal information. Then ensure the systems and staff conduct is up to scratch.<\/p>\n

CLICK HERE to submit your press release to MyPR.co.za<\/a>.<\/p>\n

Pages: Page <\/span>1<\/span> Page <\/span>2<\/a><\/div>\n

Source: MyPR.co.za<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

With the newest data privacy law in South Africa, POPIA (Protection of Personal Information Act), now having taken effect, the race continues for companies to ensure that they adhere to this important piece of legislation. But what is POPIA? While many have heard about POPIA, also known as the POPI Act, some are unsure how […]<\/p>\n","protected":false},"author":1,"featured_media":204446,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","ngg_post_thumbnail":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[9021,1],"tags":[3257],"class_list":{"0":"post-204445","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-mypr","8":"category-south-africa","9":"tag-mypr","10":"entry"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/www.myza.co.za\/press\/wp-content\/uploads\/2021\/10\/how-to-navigate-through-the-maze-that-is-popia.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/posts\/204445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/comments?post=204445"}],"version-history":[{"count":0,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/posts\/204445\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/media\/204446"}],"wp:attachment":[{"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/media?parent=204445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/categories?post=204445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.myza.co.za\/press\/wp-json\/wp\/v2\/tags?post=204445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}