Insights into PoPIA compliance

Issue 3 2021 Security Services & Risk Management

By now everyone knows PoPIA (The Protection of Personal Information Act) becomes a reality on 1 July 2021 and there will be no extensions. For those who may not have prepared or even know what they need to be doing, Hi-Tech Security Solutions asked Carrie Peter, solution owner at Impression Signatures for a few insights on what this piece of legislation means in the real world.

Hi-Tech Security Solutions: What are the realities when it comes to PoPIA compliance? Do companies have to reinvent the wheel to be compliant?

Carrie Peter: In some cases they will have to reinvent the wheel, but that will be dependent on their internal security and privacy controls. From something as simple as a customer completed form, to far more complex systems that hold deeply private data such as medical records, minimalism and privacy needs to be baked in. The extent to which a company will have to reinvent the wheel will depend on where the company is at starting position.

Carrie Peter.

Due to safety and privacy issues, many organisations may already be in a position where they have been complying to regulations, such as informing the customer of the reason for retaining information. For these organisations, compliance may just involve slight adjustments in protocol. For other organisations, compliance may entail more extensive steps and re-configurations.

Hi-Tech Security Solutions: Apart from the threats of jail for directors, what are the real risks of non-compliance (from legal and other perspectives)?

Carrie Peter In addition to potential imprisonment, non-compliance may lead to heavy fines. Section 107 of the Act states: “For the more serious offences the maximum penalties are a R10 million fine or imprisonment for a period not exceeding 10 years or to both a fine and such imprisonment. For the less serious offences, for example, hindering an official in the execution of a search and seizure warrant, the maximum penalty would be a fine or imprisonment for a period not exceeding 12 months, or to both a fine and such imprisonment.”

Further to this, the costs that can be caused by data breaches and security issues can make the fines seem light. Reputational damage, productivity losses and data losses can cause millions of rands in damage. Responding to a minor cyber incident can cost millions of rands. Organisations that do not comply also run the risk of losing the confidence of their customers and clients, since the Act has been instated to protect the privacy and confidentiality of their information, this loss of trust can potentially result in a downturn in business.

Hi-Tech Security Solutions: What should companies be ready for in terms of people asking what private information the organisations hold for them? Can an individual insist a company provides and then deletes all info they have on them? How long does a company have to supply/delete such personal information?

Carrie Peter: According to the Act, the data subject must be informed about the reason for the information requested. The organisation also has to inform the data subject about and gain permission for, the sharing of that personal information to any additional third parties. The data subject has the right to request the reason for personal information obtained at any time.

The data subject also has the right to request what information an organisation has about the subject and to order the deletion of that information. The organisation must comply and the information must be deleted immediately upon request without any penalties, conditions or fines to the data subject.

Hi-Tech Security Solutions: With 1 July looming, what are your top three tips for companies to ensure they are compliant or will be compliant?

Carrie Peter: My suggestions are:

1. Understand what private data you hold and what private data you need to hold – gather and hold only what you need.

2. Understand consent – it is fine to gather and hold data if you have consent to do so. Make sure that all data obtained has the consent of the data subject.

3. Trust no one – develop a risk management and mitigation programme and regularly assess your day-to-day practices against this. Keep record of compliance measures at all times.

For more information go to


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Communication in any situation
Issue 8 2020, Elvey Security Technologies , Global Communications , Security Services & Risk Management
Global Communications offers an industry-first with five-year warranty on select Kenwood two-way radios.

The year resilience paid off
Issue 8 2020 , Editor's Choice, Security Services & Risk Management
Hi-Tech Security Solutions spoke to Michael Davies about business continuity and resilience in a year when everything was put to the test.

Retail solutions beyond security
Issue 8 2020, Axis Communications SA, Technews Publishing, Hikvision South Africa , Editor's Choice, CCTV, Surveillance & Remote Monitoring
The need for security technology to deliver more than videos of people falling or stealing from retail stores is greater than ever.

LPR is an integrated solution
CCTV Handbook 2021, DeepAlert, XtraVision, Technews Publishing , CCTV, Surveillance & Remote Monitoring
The power of LPR is only experienced when it is integrated with other technologies, from video analytics and AI, through to connecting to external databases.

Decentralised operations is where it’s at
CCTV Handbook 2021, G4S Secure Solutions SA, Technews Publishing , Editor's Choice
Control rooms are evolving into operations centres that serve a variety of applications, such as risk management, surveillance, process management, network monitoring, personnel management and asset management.

Storage solutions for surveillance
CCTV Handbook 2021, Technews Publishing, Forbatt SA, Duxbury Networking , IT infrastructure
When it comes to storage, simply knowing where your video is stored, how to access it quickly and how to handle the large amount of data is a complex task.

Facial recognition advances
CCTV Handbook 2021, Suprema, IDEMIA , ZKTeco, Technews Publishing , Access Control & Identity Management
Reliable facial biometrics is still in the domain of access control, but integration with surveillance technologies is fast becoming a reality.

Recover your margins with services
CCTV Handbook 2021, Technews Publishing , Editor's Choice
The security industry has reached yet another inflection point with the rise of the cloud, specifically with its utility in security services which have become an operational expenditure reality.

The reality of the cloud
CCTV Handbook 2021, Technews Publishing , Editor's Choice
One unmistakable take-away from this year’s CCTV Handbook is that no matter whether it’s a hybrid or an ‘all-in’ model, the cloud is the new frontier for surveillance operations.

Cloud surveillance options from AWS
CCTV Handbook 2021, Technews Publishing , CCTV, Surveillance & Remote Monitoring
The idea of doing away with the task of managing your own IT infrastructure and simply using a reliable and scalable infrastructure, provided by and managed by someone else, seems like a good idea.