Three steps to kick-start POPIA compliance

1 August 2020 Security Services & Risk Management

The Protection of Personal Information Act (POPIA) in South Africa will come into effect on 1 July 2020. If you have waited with your compliance project, you need to act fast as you will have just 12 months “of a grace implementation period” to get ready for compliance.

In a 2019 survey conducted by Sophos, only 34% of South African organisations are reportedly ready to comply with POPIA. And complying with data privacy, security laws and regulations can be a daunting task for any organisation. Especially since requirements are vague and ambiguous, with little specific guidance as to how to achieve compliance.

So where should you begin? Here are three simple steps to help you get started:

• Start with a business privacy impact assessment. Condition 7 of the Act (‘Security Safeguards’), requires organisations to take “appropriate and reasonable measures” to safeguard personal information. The concept of acting ‘reasonably’ is used in many privacy laws all over the world and requires a business to do what is appropriate to protect its data. Note that this does not require perfection. Rather, the business must take a risk-based approach and do what is reasonable to mitigate that risk. By conducting a business privacy impact and risk assessment, you’ll identify privacy risks in your organisation and come up with a plan to either remediate or accept them.

• Prioritise your high-risk processes. High-risk processes should always come first. Start with client/customer personal data and work your way towards employee personal data. This will involve collaboration with many departments, so executive buy-in is a must; and privacy compliance should be pitched as business enablement.

• Drive a privacy and POPIA awareness campaign. Employees need to be made aware of and get trained in the security requirements of the organisation as well as learn about the basic POPIA privacy principles and how to apply these at work. Security awareness training for employees is one of the most effective means for reducing the potential for costly errors in handling sensitive information and protecting company information systems.

The new requirements around POPIA and other regulations can seem tedious, but there are plenty of resources to assist with training around POPIA, GDPR and other privacy and cybersecurity content. KnowBe4 Africa is offering a new training course on POPIA. See more at

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Meeting compliance obligations
Issue 7 2020 , Security Services & Risk Management
Helping businesses in SA understand and meet their compliance obligations to local regulations.

Industrialisation or imperialism?
Issue 7 2020 , Security Services & Risk Management
4IR has to be a matter of national agenda; national economic and political sovereignty and national security - necessitating commensurate prioritisation.

Password vulnerabilities in South Africa
Issue 7 2020, Kaspersky , Security Services & Risk Management
Research from Kaspersky has shown that people are putting their online safety at risk by making bad password decisions and simple password mistakes that may have far-reaching consequences.

The greatest crime-fighting weapon is predictably
Issue 7 2020 , Security Services & Risk Management
Predictability fuelled by artificial intelligence (AI) and big data has the ability to reduce violent crimes by 25% by 2023 according to Aura.

PCI DSS can be your PoPIA security blueprint
Issue 6 2020, Galix Group , Security Services & Risk Management
Some of the requirements of PCI DSS can also be used to comply with PoPIA, South Africa’s data privacy law.

Monopoly: AI edition
Issue 6 2020 , Security Services & Risk Management
Due to the inherent nature of artificial intelligence (AI), AI-powered industries naturally tend towards monopolisation.

eVisa solutions for Botswana
Issue 6 2020 , Security Services & Risk Management
Travelers to Botswana will soon be able to complete visa applications online and ease their entry into the country.

Digital evidence handling in the cloud
Issue 5 2020 , Security Services & Risk Management
Investigate Xpress is a free, cloud-based digital evidence management solution designed to make police forces more efficient and productive.

The evolution of security in residential estates
Residential Estate Security Handbook 2020 , Editor's Choice, Integrated Solutions, Security Services & Risk Management
Two large estates discuss their security processes and the ever-expanding scope of responsibilities they need to fulfil.

Bang for your security buck(s)
Residential Estate Security Handbook 2020, Alwinco , Editor's Choice, Security Services & Risk Management
Hi-Tech Security Solutions asks how estates can maintain a good security posture in the time of the ever-shrinking budget.