printer friendly version

POPI and the security of information

Francis Cronjé

In one of my previous articles I wrote the following: “The National Assembly approved POPI on the 11th of September 2012, leaving only the National Council of Provinces (NCOP) in its wake as a last hurdle of formality before we see enactment – POPI AT LAST!”

And a hurdle they did become. However, promulgation is back on track and although the last few delays might create frustration, it will most definitely not change the outcome POPI would have on your organisation going forward and its current way of doing business.

Businesses would especially need to start paying closer attention to the information they currently process and are supposed to govern, manage and secure.

I am sometimes dumbstruck by the lack of information governance within organisations and the sheer absence of knowledge that exists within departments as to what types of information should be protected and why.

Your typical IT department is usually made the first scapegoat when the term data protection is used and unfortunately, several companies have the same approach with POPI. Of course, several will tell you that their IT security policy is sufficient to deal with the demands of POPI and that they do not see the real difference between implementing POPI and these policies.

Such assumption cannot be further from the truth, but although the security of personal information is only but one aspect of POPI, it remains very important. This can be illustrated at the hand of POPI’s 7th condition which states the following:

A responsible party must secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent:

* Loss of, damage to or unauthorised destruction of personal information; and

* Unlawful access to or processing of personal information.

In order to give effect to these measures, the responsible party must take reasonable measures to:

* Identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control;

* Establish and maintain appropriate safeguards against the risks identified;

* Regularly verify that the safeguards are effectively implemented; and ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.

It then continues to state that the responsible party must have due regard to generally accepted information security practices and procedures which may apply to it generally or be required in terms of specific industry or professional rules and regulations.

This is the first time that we have legislation that obliges companies to comply with information security standards.

Remember, when we speak about information security, it includes:

* IT security and physical security.

* Logical and access controls.

* Soft copies and hard copies.

* Flash disks and paper.

We are therefore not just talking about the role of it, but also about the role of the facilities department, the records manager, the information manager, and most importantly, each and every employee.

“How do we ensure our employees secure information?” you might ask.

There are obviously various factors you need to consider and various ways of approaching this, but the most important would be to sort out your information governance.

Follow this up with information security and privacy/data protection policies that are:

* Relevant.

* Understandable.

* Concise, and

* Very important, achievable.

Please remember that if you are a smaller sized company, information governance might not initially or necessarily ring home, but everyone should have policies. The success of policy implementation is largely dependent on awareness and training.

POPI and King III oblige organisations to rethink their approach in terms of policies as well as the implementation thereof and companies should therefore align their policies to incorporate the changes and standards legislation require.

Share this article:

Further reading: