POPI and the security of information

April 2013 News

Francis Cronjé
Francis Cronjé

In one of my previous articles I wrote the following: “The National Assembly approved POPI on the 11th of September 2012, leaving only the National Council of Provinces (NCOP) in its wake as a last hurdle of formality before we see enactment – POPI AT LAST!”

And a hurdle they did become. However, promulgation is back on track and although the last few delays might create frustration, it will most definitely not change the outcome POPI would have on your organisation going forward and its current way of doing business.

Businesses would especially need to start paying closer attention to the information they currently process and are supposed to govern, manage and secure.

I am sometimes dumbstruck by the lack of information governance within organisations and the sheer absence of knowledge that exists within departments as to what types of information should be protected and why.

Your typical IT department is usually made the first scapegoat when the term data protection is used and unfortunately, several companies have the same approach with POPI. Of course, several will tell you that their IT security policy is sufficient to deal with the demands of POPI and that they do not see the real difference between implementing POPI and these policies.

Such assumption cannot be further from the truth, but although the security of personal information is only but one aspect of POPI, it remains very important. This can be illustrated at the hand of POPI’s 7th condition which states the following:

A responsible party must secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent:

* Loss of, damage to or unauthorised destruction of personal information; and

* Unlawful access to or processing of personal information.

In order to give effect to these measures, the responsible party must take reasonable measures to:

* Identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control;

* Establish and maintain appropriate safeguards against the risks identified;

* Regularly verify that the safeguards are effectively implemented; and ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.

It then continues to state that the responsible party must have due regard to generally accepted information security practices and procedures which may apply to it generally or be required in terms of specific industry or professional rules and regulations.

This is the first time that we have legislation that obliges companies to comply with information security standards.

Remember, when we speak about information security, it includes:

* IT security and physical security.

* Logical and access controls.

* Soft copies and hard copies.

* Flash disks and paper.

We are therefore not just talking about the role of it, but also about the role of the facilities department, the records manager, the information manager, and most importantly, each and every employee.

“How do we ensure our employees secure information?” you might ask.

There are obviously various factors you need to consider and various ways of approaching this, but the most important would be to sort out your information governance.

Follow this up with information security and privacy/data protection policies that are:

* Relevant.

* Understandable.

* Concise, and

* Very important, achievable.

Please remember that if you are a smaller sized company, information governance might not initially or necessarily ring home, but everyone should have policies. The success of policy implementation is largely dependent on awareness and training.

POPI and King III oblige organisations to rethink their approach in terms of policies as well as the implementation thereof and companies should therefore align their policies to incorporate the changes and standards legislation require.

For more information contact Francis Cronjé, [email protected], www.franciscronje.com

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Johnny Aucamp joins iPulse exco
Johnny Aucamp has joined iPulse Systems as its chief sales officer (CSO), adding a massive boost to the executive team.

From the editor's desk: Security and resilience
Technews Publishing News
It’s often said that South Africans are a resilient bunch, and history has proven this correct. When it comes to security, both cyber and physical, resilience is key to an effective defensive plan. ...

Hikvision aims for solutions
Technews Publishing Hikvision South Africa Editor's Choice CCTV, Surveillance & Remote Monitoring News Integrated Solutions Conferences & Events
Hikvision recently held a roadshow titled Industry X, where the company highlighted its latest products and solutions, supported by partners and distributors.

Olarm launches PRO 4G communicator
Olarm News Perimeter Security, Alarms & Intruder Detection Products
Olarm has announced an additional 4G/LTE version of its Olarm PRO smart communicator. It is aimed at areas suffering from poor connectivity by providing support for 4G, 2G and Wi-Fi networks.

ADI Expo returns to South Africa
Technews Publishing ADI Global Distribution News
September saw the return of the ADI Expo to South Africa. The Johannesburg event was held at the Focus Rooms and the Durban event, two days later, at the Southern Sun Elangeni & Maharani.

Technoswitch Awards dinner for 2022
Technews Publishing News Fire & Safety
Technoswitch hosted its fifth awards dinner at Montecasino in September, where customers and suppliers celebrated a year of success.

Suprema joins FiRa Consortium
Suprema News Access Control & Identity Management
Suprema recently became a member of the FiRa Consortium, a consultative body that establishes standards for ultra-wideband (UWB) technology, the next generation of wireless communication.

Reliable, low-maintenance video appliances
Technews Publishing Editor's Choice CCTV, Surveillance & Remote Monitoring News IT infrastructure Products
Symetrix, part of the Agera Group, has added the AES range of video recording servers, storage appliances and workstations to its portfolio.

ZYTEQ Fire Engineering Summit 2022
ZYTEQ Fire Fire & Safety News
Cape Town-based ZYTEQ Fire hosted its inaugural Engineering Summit at the Commodore Hotel in Cape Town and the Leonardo Hotel in Sandton, Johannesburg.

Nomad launches early adopter programme
Editor's Choice News Integrated Solutions Smart Home Automation
Participants in Nomad’s Early Adopter Programme will receive 10% of their volume order to facilitate testing before the commercial launch later this year.