Data protection legislation in a nutshell

July 2012 Security Services & Risk Management

When an organisation’s client, employee or customer’s personal details or information goes missing (for example, through human error, theft, hacking, data loss, or any other variety of data breaches), chances are good that these persons or so-called data subjects would not be made aware thereof by the organisation. In most instances, these data subjects’ first awareness would most probably be at the hand of fraudsters utilising their personal information to open bogus financial or retail accounts or to gain access to the data subjects’ existing accounts.

This usually leaves victims of such information theft with irrevocable harm that might range from bad credit records to unending lawyers’ letters. Examples are rife and it has been reported elsewhere that identity theft costs the country in the region of one billion rand per year. The bottom line; personal information is big business.

Until now in South Africa, organisations have paid little or no attention to the protection of personal information and data subjects have been left to fit the bill for their own financial, legal, administrative and emotional distress when data breaches affect them. Concomitantly, organisations have turned a blind eye. That however is all about to change and is already changing due to South Africa’s own data protection initiative; the soon to be promulgated Protection of Personal Information Act (POPI) whereby data subjects will not only have recourse to legislation but also access to and protection under POPI’s enforcer, the Information Regulator.

Under POPI, almost every person or organisation that processes (collects, uses, retains, stores or destroys) personal information would be held accountable for that information. Typical examples of personal information are information relating to an identifiable, living person’s name, address, e-mail address, telephone number, race, gender, account numbers, blood type, ID number etc.

Accountability means that organisations that are subject to POPI would have to ensure conditions for lawful processing. Such conditions are:

* A limitation on the processing of personal information (one would, for instance, only be allowed to process personal information if you have obtained the data subject’s consent);

* Purpose specification (personal information must be collected for a specific purpose and can only be retained for as long as necessary);

* Further processing limitation (in other words, not to process personal information for any additional purposes beyond the initial purpose or data subject’s consent);

* Information quality (the organisation must ensure that the personal information is accurate, complete, not misleading and updated where necessary);

* Openness (organisations must make the data subject aware of the information being collected and indicate for what purpose it is going to be utilised or processed);

* Security safeguards (ensuring the confidentiality, integrity and availability of personal information according to best practice but also ensuring that third parties processing on your behalf, comply with the same rigorous standards); and

* Data subject participation (facilitating processes whereby data subjects can amend or correct information pertaining to them).

From a technological and IT perspective certain aspects contained in these conditions stand out:


* Information and data classification;

* Retention and backup;

* Information and data quality;

* Information and IT security; and for the purpose of our conclusion below, more significantly.

* Third-party processors.

Third-party processors, those organisations that make your organisation’s processing troubles seemingly go away, are now your organisation’s responsibility, under POPI, that is.

If personal information belonging to your organisation processed by these third-parties ends up in the form of a laptop on eBay, or goes astray and data subjects’ information is exposed or misplaced, then your organisation would be held accountable. And no, you cannot contract yourself out of a statutory duty.

So next time when a cloud computing service provider tells you that cloud computing has become a hot topic in the CIO’s arsenal and that IT departments across the board have discovered that the cloud is a significant weapon in freeing up budget, think carefully as to which questions you should really be asking them.

In my next article, I will be addressing some of these.

Francis Cronjé
Francis Cronjé

Francis Cronjé is an information governance specialist with a strong legal background having completed his LLM at the University of Oslo in Norway on ICT Law and Data Protection. He completed his BLC and LLB degrees at the University of Pretoria and obtained CIPP/US and CIPP/IT certification from the International Association of Privacy Professionals. He is the co-editor and co-author of Cyberlaw@SA and is heading up the consultancy firm, Φ

For more information contact Francis Cronjé,,

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Convergence of cyber and physical security
Integrated Solutions Security Services & Risk Management
The overlap between cybersecurity and physical security will necessitate the integration of cyber and physical security in order to enable the sharing of events to the same security operations centre.

Reduce electrical risks in commercial and industrial buildings
Security Services & Risk Management
Eaton’s new whitepaper aims to help professionals reduce electrical risks in commercial and industrial buildings and prevent faults that can endanger workers, damage property and disrupt business continuity.

Sustainability School opens for enrolment
Education (Industry) News Security Services & Risk Management
Three-part programme, first developed for Schneider Electric employees, is now available for free for companies worldwide. Attendees learn how to future-proof their businesses and accelerate their decarbonisation journeys.

Success in business process best practices
Technews Publishing Kleyn Change Management Editor's Choice Integrated Solutions Security Services & Risk Management
This month we commandeer time with the woman who is spearheading our national conversation on Women in Security, Lesley-Anne Kleyn, to get to know the lady herself a little better.

Security awareness training
Training & Education Security Services & Risk Management
It is critically important to have a security awareness solution that uses the limited time available to train effectively, and one that provides targeted education that is relevant to users.

Technology to thwart solar panel thieves
Asset Management, EAS, RFID Security Services & Risk Management Products
A highly efficient industrial network is coming to the rescue of the solar industry, as solar panels, inverters and batteries are being targeted by thieves and threaten to destabilise the industry.

Banking the unbanked comes with security risks
Financial (Industry) Security Services & Risk Management
As grim as it was, the pandemic of recent years and its resultant global economic crisis were a prime catalyst for record number of first-time bank users, the previously unbanked.

Security is like infinity
Alwinco Security Services & Risk Management
Security needs constant attention, dedication and input. The scary thing is that most people think that security is something that you buy, install, and then forget about.

Vulnerabilities in industrial cellular routers’ cloud management platforms
Industrial (Industry) Cyber Security Security Services & Risk Management
Research from OTORIO, a provider of operational technology cyber and digital risk management solutions, unveils cyber risks in M2M protocols and asset registration that expose hundreds of thousands of devices and OT networks to attack

SAFPS to launch a platform to combat fraud
Editor's Choice News Security Services & Risk Management
In response to the growing need for a proactive approach to fraud prevention, the SAFPS is developing a product called Yima, which will be a one-stop-shop for South Africans to report scams, secure their identity, and scan any website for vulnerabilities.