Insights into PoPIA compliance

Issue 3 2021 Security Services & Risk Management

By now everyone knows PoPIA (The Protection of Personal Information Act) becomes a reality on 1 July 2021 and there will be no extensions. For those who may not have prepared or even know what they need to be doing, Hi-Tech Security Solutions asked Carrie Peter, solution owner at Impression Signatures for a few insights on what this piece of legislation means in the real world.

Hi-Tech Security Solutions: What are the realities when it comes to PoPIA compliance? Do companies have to reinvent the wheel to be compliant?

Carrie Peter: In some cases they will have to reinvent the wheel, but that will be dependent on their internal security and privacy controls. From something as simple as a customer completed form, to far more complex systems that hold deeply private data such as medical records, minimalism and privacy needs to be baked in. The extent to which a company will have to reinvent the wheel will depend on where the company is at starting position.

Carrie Peter.

Due to safety and privacy issues, many organisations may already be in a position where they have been complying to regulations, such as informing the customer of the reason for retaining information. For these organisations, compliance may just involve slight adjustments in protocol. For other organisations, compliance may entail more extensive steps and re-configurations.

Hi-Tech Security Solutions: Apart from the threats of jail for directors, what are the real risks of non-compliance (from legal and other perspectives)?

Carrie Peter In addition to potential imprisonment, non-compliance may lead to heavy fines. Section 107 of the Act states: “For the more serious offences the maximum penalties are a R10 million fine or imprisonment for a period not exceeding 10 years or to both a fine and such imprisonment. For the less serious offences, for example, hindering an official in the execution of a search and seizure warrant, the maximum penalty would be a fine or imprisonment for a period not exceeding 12 months, or to both a fine and such imprisonment.”

Further to this, the costs that can be caused by data breaches and security issues can make the fines seem light. Reputational damage, productivity losses and data losses can cause millions of rands in damage. Responding to a minor cyber incident can cost millions of rands. Organisations that do not comply also run the risk of losing the confidence of their customers and clients, since the Act has been instated to protect the privacy and confidentiality of their information, this loss of trust can potentially result in a downturn in business.

Hi-Tech Security Solutions: What should companies be ready for in terms of people asking what private information the organisations hold for them? Can an individual insist a company provides and then deletes all info they have on them? How long does a company have to supply/delete such personal information?

Carrie Peter: According to the Act, the data subject must be informed about the reason for the information requested. The organisation also has to inform the data subject about and gain permission for, the sharing of that personal information to any additional third parties. The data subject has the right to request the reason for personal information obtained at any time.

The data subject also has the right to request what information an organisation has about the subject and to order the deletion of that information. The organisation must comply and the information must be deleted immediately upon request without any penalties, conditions or fines to the data subject.

Hi-Tech Security Solutions: With 1 July looming, what are your top three tips for companies to ensure they are compliant or will be compliant?

Carrie Peter: My suggestions are:

1. Understand what private data you hold and what private data you need to hold – gather and hold only what you need.

2. Understand consent – it is fine to gather and hold data if you have consent to do so. Make sure that all data obtained has the consent of the data subject.

3. Trust no one – develop a risk management and mitigation programme and regularly assess your day-to-day practices against this. Keep record of compliance measures at all times.

For more information go to


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Communication in any situation
Issue 8 2020, Elvey Security Technologies , Global Communications , Security Services & Risk Management
Global Communications offers an industry-first with five-year warranty on select Kenwood two-way radios.

The year resilience paid off
Issue 8 2020 , Editor's Choice, Security Services & Risk Management
Hi-Tech Security Solutions spoke to Michael Davies about business continuity and resilience in a year when everything was put to the test.

Retail solutions beyond security
Issue 8 2020, Axis Communications SA, Technews Publishing, Hikvision South Africa , Editor's Choice, CCTV, Surveillance & Remote Monitoring
The need for security technology to deliver more than videos of people falling or stealing from retail stores is greater than ever.

One lock to rule them all?
Issue 3 2021, ASSA ABLOY South Africa, Technews Publishing , Financial (Industry)
eCLIQ is a multi-layered locking system which combines key-operated mechanical and electronic protection through a range of high-security cylinders and padlocks for applications beyond doors.

From the editor's desk: Privacy is your responsibility
Issue 3 2021, Technews Publishing , News
We have a look at the Protection of Personal Information Act (PoPIA) in this issue, which is set to become a reality as of 1 July. We didn’t have space for much information, but more on the topic will ...

The reality of farm attacks
Issue 3 2021, Technews Publishing , Security Services & Risk Management
Nowhere in the world are people being as brutally attacked and murdered like farmers in South Africa (including a number of black emerging farmers and black farm labourers that have been attacked and injured or killed).

Top 10 security misperceptions
Issue 3 2021 , Cyber Security, Security Services & Risk Management
The Sophos Rapid Response team has compiled a list of the most commonly held security misperceptions they’ve encountered in the last 12 months while neutralising and investigating cyberattacks in a wide range of organisations.

The supply chain of the future
Issue 3 2021 , Integrated Solutions, Security Services & Risk Management, Retail (Industry)
For retailers to maximise their bottom line, the supply chain needs to be fast, efficient and responsive, which requires the use of intelligent, integrated technology.

PoPIA: Time Is up
Issue 3 2021 , Security Services & Risk Management, IT infrastructure
The Protection of Personal Information Act (PoPIA) comes into full effect on 1 July 2021 and there remains much confusion and ambiguity regarding its definitions, requirements and enforcement.

Anomaly detection is the first layer
Issue 3 2021 , Security Services & Risk Management
A multi-layered, proactive approach to data management and protection is essential and this begins with anomaly detection as the first line of defence.