Central control over sensitive data

Issue 5 2021 Security Services & Risk Management

Just as the European Union’s (EU) General Data Protection Regulation (GDPR) has had a huge impact on EU businesses and the multinational organisations handling their data, the Protection of Personal Information Act (PoPIA) in South Africa is set to have a similar effect.

The EU enacted its privacy legislation five years ago, however, today there is a growing list of companies large and small which have been fined. After a number of years in the legislative process, PoPIA has now been enacted in law and judging by the stance of the regulator in the run-up to full enactment, there may be some unpleasant surprises ahead for those companies who have taken a wait-and-see approach.


Chris Visagie.

GDPR has much to teach us in terms of mandates and the underlying principles of regulatory law. It is all about compliance and defining the consequences of not getting those regulatory ducks in a row, and delivers a fundamental change in how data controllers and data processors handle personal data.

Data has become a critical commodity, with organisations generating vast amounts of it. With the enforcement of PoPIA companies need to ensure that data is protected, however, firstly they need to know where the data is located and what the data contains before they can protect it. They also would need to understand the lifecycle and usage of data to be able to ensure the correct controls are applied.

If companies are to achieve PoPIA compliance, they will need to develop a strong understanding of their structured and unstructured data – doing this will enable them to drive transparency and consent. This also puts businesses in a position to minimise the data being kept including providing the capability to dispose of or rectify data – this can also assist with decreasing organisational risk.

The final part of the picture is the immensely important issue of security – if breaches are to be prevented, access control and data protection techniques need to be applied to ensure data protection.

Technology, the principal problem

PwC defines the role of technology as the principal factor in achieving GDPR compliance. They provide a set of recommendations which can equally be applied to PoPIA, such as the interpretation of requirements, mapping the technologies in play and quickly identifying the correct information that needs to be managed and protected.

Information insight is the key to solving these challenges of large volumes of data and high levels of complexity. The risks are high, lost customer confidence, security breaches, fines, sanctions and potential lawsuits. Organisations failing to translate compliance requirements into their technology stack run the risk of operational failure, which can, in turn, lead to reputational and legal damage.

Businesses need to learn how technology plays a key role in an organisation’s journey towards compliance. Instead of an ‘add-on’ or afterthought within business operations, protections for personal data need to be woven into the very fabric of data processing systems, meaning that entities must re-examine how they approach the use of technology in their organisations.

As such, it is obvious that, as well as being the problem, technology must provide the solution. If entities are storing too much personal data, for example, technology needs to deliver delete, erase, de-duplication and minimisation functionality.

The privacy challenges of data-driven businesses

Today’s data-driven businesses rely on analytics insights for creating customer value, maximising operational efficiencies and achieving competitive edge. More data than ever before is capturedand flows throughout enterprises from millions of IoT smart devices at the edge of the network, through thousands of applications, to repositories on-premises and on public and private cloud.

The issue is that among the terabytes of data captured by enterprises, there is highly sensitive information that if breached, could prove to be seriously damaging to a business. Breaches lead to loss of revenue and a decline in brand loyalty.

The challenge is that as data moves across modern IT in ever growing volumes. Security and privacy controls lacking co-ordination between silos and with no central policy management become ineffective. Businesses often don’t know what the sensitive data is that they are holding, nor where it’s located, where it flows or who is using it. If this sounds familiar it’s because you also have no central control over data privacy policy management and governance in your company. Privacy legislation strives to make data privacy requirements stricter by increasing penalties for data breaches and the solution will be the implementation of much needed central control over the usage of sensitive data.

So, a new approach is needed. Sensitive data must be identified, classified and protected, through a single pane of glass methodology that applies the appropriate level of privacy controls to data according to sensitivity and usage requirements. If this is to be achieved, businesses must orchestrate and govern data privacy at a higher level that attains complete visibility and creates greater efficiencies while eliminating gaps.

This comprehensive data privacy management approach allows organisations to automate the process, maintain regulatory privacy compliance and create a balance between risk exposure and the need to use data for competitive advantage.

Find out more at iOCO, +27 11 607 8100, [email protected], https://ioco.tech/




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

SAFPS issues SAPS impersonation scam warning
News & Events Security Services & Risk Management
The Southern African Fraud Prevention Service (SAFPS) is warning the public against a scam in which scammers pose as members of the South African Police Service (SAPS) and trick and intimidate individuals into handing over personal and financial information.

Read more...
Rewriting the rules of reputation
Technews Publishing Editor's Choice Security Services & Risk Management
Public Relations is more crucial than ever in the generative AI and LLMs age. AI-driven search engines no longer just scan social media or reviews, they prioritise authoritative, editorial content.

Read more...
How can South African organisations fast-track their AI initiatives?
AI & Data Analytics Security Services & Risk Management
While the AI market in South Africa is anticipated to grow by nearly 30% annually over the next five years, tapping into the promise and potential of AI is not easy.

Read more...
Efficient, future-proof estate security and management
Technews Publishing ElementC Solutions Duxbury Networking Fang Fences & Guards Secutel Technologies OneSpace Technologies DeepAlert SMART Security Solutions Editor's Choice Information Security Security Services & Risk Management Residential Estate (Industry) AI & Data Analytics IoT & Automation
In February this year, SMART Security Solutions travelled to Cape Town to experience the unbelievable experience of a city where potholes are fixed, and traffic lights work; and to host the Cape Town SMART Estate Security Conference 2025.

Read more...
Stallion repositions itself as a services provider
News & Events Security Services & Risk Management
Stallion has rebranded as Stallion Integrated Solutions to reflect its expanded capabilities beyond traditional security services to delivering integrated solutions that enhance safety, asset management, and operational efficiency.

Read more...
Seven tips to help ensure your backup batteries work
Power Management Security Services & Risk Management
Load shedding is back, officially or not. Lance Dickerson offers seven tips to prolong the life of your power backup systems and ensure they perform as intended when needed.

Read more...
Cybersecurity best practice
Information Security Security Services & Risk Management
Breach and attack simulation has become an essential element of cybersecurity strategies in any modern business by allowing companies to actively detect and resolve vulnerabilities through real-world attack simulations.

Read more...
Historic Collaboration cuts ATM Bombings by 30%
Online Intelligence Editor's Choice News & Events Security Services & Risk Management
Project Big-Bang, a collaborative industry-wide task team, has successfully reduced ATM bombings in South Africa by 30,7% during the predetermined measurement period of November, December and January 2024/5.

Read more...
Keeping safety central to enterprise risk management
Zulu Consulting Security Services & Risk Management
[Sponsored] As employee safety becomes an ever-more critical aspect of corporate risk management, Risk-IO assists risk managers in ensuring a safe working environment, whether in an industrial setting, an office, or anywhere.

Read more...
Empower individuals to control their biometric data
Information Security Access Control & Identity Management Security Services & Risk Management
What if your biometrics, now embedded in devices, workplaces, and airports, promising seamless access and enhanced security, was your greatest vulnerability in a cyberattack? Cybercriminals are focusing on knowing where biometric data is stored.

Read more...