Information protection resources for video surveillance companies

Issue 3 2021 Editor's Choice

Cathexis Technologies values data protection. It is also committed to helping its clients comply with data protection laws. Cathexis has therefore produced a PoPIA Privacy Guide[1] that provides guidelines for understanding and applying personal data protection when using CathexisVision video surveillance management software.

The Protection of Personal Information Act (PoPIA) was signed into law in South Africa in 2013, with various sections coming into effect in the years that followed. It is a comprehensive law which aims to protect individuals’ personal data, by holding organisations accountable for capturing, processing and storing personal information responsibly. What is personal information? Under PoPIA, it is data that identifies, relates to, describes, or could reasonably be linked with a particular consumer.

While the deadline for companies to register a data protection officer has already passed (31 March 2021), the deadline for enforcement of PoPIA by the Information Regulator is 1 July 2021. PoPIA applies to any organisation operating in South Africa, or organisations operating outside South Africa which offer products and services to customers or businesses within South Africa. Compliance depends on the combination of an organisation’s access to and use of personal data.

Eight conditions[2] form the foundation of compliance and determine how personal information may be legally gathered, processed and held under the Act: accountability, processing limitations, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. PoPIA also outlines rights which authorise people to know the operator’s purpose in using their personal data and allows them to check that it is being carried out lawfully.

Privacy is necessarily about security: for information to remain private, it must also be held securely. By strengthening your organisation’s cybersecurity measures, you can strengthen its likelihood of compliance with the PoPI Act. Why is compliance important? There are risks to non-compliance: damage to the company’s reputation and enforcement action by the Information Regulator.

As the limits of PoPIA have not yet been tested by the courts and Information Regulator, the best business plan is to act to mitigate risks and prioritise personal data protection. Yet compliance is not simply about avoiding penalties. By developing an organisational culture underpinned by cybersecurity and respect for your customers’ privacy rights, your company can protect its brand, gain a competitive advantage and build trust with consumers.

Privacy by design is a core principle of the Protection of Personal Information Act. Privacy and security need to be embedded within all of your organisation’s practices, systems and technology, demonstrating a culture of data protection. In short, your company needs to know and document what data it holds, its source, who it is shared with and how it is used.

The features in CathexisVision software that support PoPIA compliance measures include optional database shredding, data encryption, video signing, archive security, password control and watermark overlays on video footage. For more information, you can consult the official PoPIA website[3] and the PoPIA Privacy Guide[1] developed by Cathexis Technologies, which has been tailored to address compliance in the security sector and the use of video surveillance software.

Steps to take to ensure PoPIA compliance within your organisation

• Appoint an information officer and deputy within the organisation.

• Train staff in data protection and PoPIA compliance.

• Carry out a personal information impact assessment to assess your company’s compliance.

• Develop a compliance framework which includes the organisation’s policies regarding data collection, usage, storage, and security and the company process for handling complaints.

• Document all personal data processing activities.

• Communicate clearly with data subjects and customers: make it easy for them to access Data Subject Access Request forms and provide on-site and online notices when collecting personal information.

• Ask for data subjects’ consent when collecting information, record that consent and review the company’s processes for requesting and recording consent.

• Only store personal data as long as is necessary for the original lawful purpose of its collection.

• Create procedures for responding to data subject access requests and an information security policy for identifying and managing possible data breaches.

• Depending on the size of your company and the scale of data processing it carries out, budget for compliance measures, covering legal help, assessments, insurance and training.

For more information contact Cathexis Africa, +27 31 240 0800,,





Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

What South Africans need to know about smart devices
Technews Publishing Editor's Choice
We live in a world surrounded by smart devices, from our pockets to our driveways and living rooms.

From overwhelm to oversight
Editor's Choice Cyber Security Products
Security automation is vital in today’s world, and Microsoft Sentinel is a widely adopted, but complex answer. ContraForce is an easy-to-use add-on that automatically processes, verifies and warns of threats round-the-clock.

SMART Surveillance Conference 2023
Technews Publishing Editor's Choice CCTV, Surveillance & Remote Monitoring Conferences & Events
Some people think the future is all about cloud technologies, but the SMART Surveillance conference demonstrated that AI is making edge surveillance much more attractive, over distributed sites, than ever before.

Has your business planned for the worst?
Editor's Choice Cyber Security Security Services & Risk Management
Incident response is a specialised part of security, like a hospital's intensive care unit: IR kicks in when the organisation detects a breach of its systems to stop criminals from doing more damage.

Making a difference with human intelligence gathering
Kleyn Change Management Editor's Choice
Eva Nolle believes that woman should stand their ground as they often bring an entirely different skill set to the table, which enhances the overall service delivered.

Milestone celebrates women in security
Milestone Systems Technews Publishing Editor's Choice News Conferences & Events
The Milestone Systems’ African team wanted to express their appreciation for the incredible contributions of the women in the security industry and held a breakfast in honour of the hard-working women in the industry on 8 August.

Supporting CCTV intelligence with small and big data
Leaderware Editor's Choice CCTV, Surveillance & Remote Monitoring
The increasing development of AI and its role in enhancing investigation-led surveillance, and the increasing capacity of control rooms and local analysts to deliver data in return, can increase the synergy between intelligence and surveillance.

Overcoming resistance to changing your current operating model
Editor's Choice Integrated Solutions
Business survival goes beyond cutting costs and driving efficiency, it’s about using data and technology as strategic assets to develop speed, agility and resilience, keep up with customer demands, beat the competition and grow the business.

The road to Zero Trust not necessarily paved with gold
Editor's Choice Access Control & Identity Management Cyber Security
Paul Meyer says that while Zero Trust must be the goal, there are a few potholes to navigate on the journey. Here he expands on these caveats, but also exposes the greatest ally of Zero Trust.

More agile, flexible access management
ASSA ABLOY South Africa Editor's Choice Access Control & Identity Management
Tim Timmins from ASSA ABLOY Opening Solutions examines the growing shift towards cloud access management. How can organisations benefit, and what should they look for when choosing a cloud access control solution?