POPI at last

October 2012 Security Services & Risk Management

In my July article I gave a brief summary of the proposed Protection of Personal Information Bill (POPI) and highlighted the impact that such legislation will have on businesses. This was followed by an article explaining subsequent consequences POPI might have on cloud computing.

For many however, this was just more articles on another piece of legislation, which until now, was a draft bill marred by years and years of delay. To be honest, it was the oldest bill in Parliament, there since 2009, never mind the fact that work on it already started at the beginning of the century. Least to say, interest in POPI dwindled and many among us started doubting any early release, enactment or promulgation of POPI.

I even had some clients telling me that they shifted POPI remediation to the bottom of their priorities and others even took it so far by removing it entirely from their corporate to-do list. How wrong they were.

The National Assembly approved POPI on the 11th of September 2012, leaving only the National Council of Provinces (NCOP) in its wake as a last hurdle of formality before we see enactment.

In its defence, to be quite honest, there was a good reason for all the delays. It is no easy piece of legislation. In fact, while assisting the drafters with POPI in parliament, I was told that this is the most difficult piece of legislation they had ever embarked on, never mind for those organisations striving for compliance.

My years of experience in this field necessitate me to concur and I only have this message to businesses across all sectors: “Now is the time to embark on your POPI project.”

But why, you may ask.

There are different reasons for different sizes of companies and this might influence the answer, but one thing is for sure, irrelevant of your organisation’s size or regulatory landscape – POPI is complex and requires time to implement.

Unlike most pieces of legislation, POPI touches on almost every aspect of your business and do not think for one second that by having great IT security you are covered.

Countless organisations will let you believe that their IT department has got POPI covered. This, if left to be true, is the worst approach to POPI any organisation can follow. It is fundamental to understand that you cannot have privacy without security, but, you can most definitely have security without privacy. And this is true in most instances where IT is allowed to run the show – no complete privacy.

Remember, when embarking on a POPI project, it is imperative to realise that it should be done by business in conjunction with IT and not the other way round. To give the reader an idea of some the complexities faced by organisations when dealing with POPI, I listed only some of the key challenges during remediation:

1. Training and awareness;

2. Information and/or data classification;

3. Records and/or document management;

4. Information governance;

5. Legal and compliance;

6. Third parties;

7. Marketing;

8. Human resources (HR);

9. Regulator interaction;

10. Data subject requests etc.

The above and shortened list clearly demonstrates aspects beyond IT and IT security. IT should therefore merely be seen as an implementer and facilitator of certain POPI deliverables, rather than the decision maker when seeking compliance.

The same can be said of the trusted compliance department. Do not believe that POPI can be successfully implemented by merely applying your legal savvy; an holistic approach should be followed by carefully crafting a project team that have a myriad of experience across a wide range of fields.

So what now?

Get expert advice and start by conducting a Privacy Gap Analysis to establish the scope of the affected area within your organisation.

It might still be a while before POPI’s Information Regulator becomes fully functional, thereafter one will still have a year before complying, but as with POPI’s drafting and implementation, POPI remediation can and usually does, take a very long time.

Francis Cronjé.
Francis Cronjé.

Francis Cronjé is an information governance specialist with a strong legal background having completed his LLM at the University of Oslo in Norway on ICT Law and Data Protection. He completed his BLC and LLB degrees at the University of Pretoria and obtained CIPP/US and CIPP/IT certification from the International Association of Privacy Professionals. He is the co-editor and co-author of Cyberlaw@SA and is heading up the consultancy firm, Φ franciscronje.com

For more information contact Francis Cronjé, [email protected], www.franciscronje.com





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

SAFPS issues SAPS impersonation scam warning
News & Events Security Services & Risk Management
The Southern African Fraud Prevention Service (SAFPS) is warning the public against a scam in which scammers pose as members of the South African Police Service (SAPS) and trick and intimidate individuals into handing over personal and financial information.

Read more...
Rewriting the rules of reputation
Technews Publishing Editor's Choice Security Services & Risk Management
Public Relations is more crucial than ever in the generative AI and LLMs age. AI-driven search engines no longer just scan social media or reviews, they prioritise authoritative, editorial content.

Read more...
How can South African organisations fast-track their AI initiatives?
AI & Data Analytics Security Services & Risk Management
While the AI market in South Africa is anticipated to grow by nearly 30% annually over the next five years, tapping into the promise and potential of AI is not easy.

Read more...
Efficient, future-proof estate security and management
Technews Publishing ElementC Solutions Duxbury Networking Fang Fences & Guards Secutel Technologies OneSpace Technologies DeepAlert SMART Security Solutions Editor's Choice Information Security Security Services & Risk Management Residential Estate (Industry) AI & Data Analytics IoT & Automation
In February this year, SMART Security Solutions travelled to Cape Town to experience the unbelievable experience of a city where potholes are fixed, and traffic lights work; and to host the Cape Town SMART Estate Security Conference 2025.

Read more...
Stallion repositions itself as a services provider
News & Events Security Services & Risk Management
Stallion has rebranded as Stallion Integrated Solutions to reflect its expanded capabilities beyond traditional security services to delivering integrated solutions that enhance safety, asset management, and operational efficiency.

Read more...
Seven tips to help ensure your backup batteries work
Power Management Security Services & Risk Management
Load shedding is back, officially or not. Lance Dickerson offers seven tips to prolong the life of your power backup systems and ensure they perform as intended when needed.

Read more...
Cybersecurity best practice
Information Security Security Services & Risk Management
Breach and attack simulation has become an essential element of cybersecurity strategies in any modern business by allowing companies to actively detect and resolve vulnerabilities through real-world attack simulations.

Read more...
Historic Collaboration cuts ATM Bombings by 30%
Online Intelligence Editor's Choice News & Events Security Services & Risk Management
Project Big-Bang, a collaborative industry-wide task team, has successfully reduced ATM bombings in South Africa by 30,7% during the predetermined measurement period of November, December and January 2024/5.

Read more...
Keeping safety central to enterprise risk management
Zulu Consulting Security Services & Risk Management
[Sponsored] As employee safety becomes an ever-more critical aspect of corporate risk management, Risk-IO assists risk managers in ensuring a safe working environment, whether in an industrial setting, an office, or anywhere.

Read more...
Empower individuals to control their biometric data
Information Security Access Control & Identity Management Security Services & Risk Management
What if your biometrics, now embedded in devices, workplaces, and airports, promising seamless access and enhanced security, was your greatest vulnerability in a cyberattack? Cybercriminals are focusing on knowing where biometric data is stored.

Read more...