The POPI Act of 2020, also known as a Privacy Policy, is South Africa's law around data protection, specifically online and how it is kept, stored and distributed within an organisation. With information and data being processed at a rapid rate, it's important that each country stays on top of its privacy policies and controls, to ensure the legal system is clear around online data and privacy. The POPI Act requires that you register a business "Information Officer" along with a declaration on the data collected, its source and why you are collecting the data. It also allows there to be a data tracking system, where they will be able to clearly see who uses what data where, hopefully helping expose data leaks faster in the future.
There is no reason to panic as a business or as an individual when it comes to the POPI Act and being compliant. We will give you a summary right here. Starting with: how does a business go about identifying all its data sources? While easy for small businesses, this can be a daunting task for larger firms.
Here is the basic POPI procedure to follow, to get any big or small corporation in line with POPI:
- Register your business's POPI information and declare information officers here: justice.gov.za/inforeg/portal
- Send your POPI Act Policy to current suppliers and customers.
- Display your POPI Act Policy on your website.
- ALWAYS ensure your company data is well protected and secure. NEVER sell your data to any corporation or individual; this is a criminal offence.
While the above is easy enough, it's important that your business ensures it is POPI compliant and safe. How do you even begin to do this? We are going to tell you...
Name Information Officers
How this is done is completely up to the business. There is a lot of responsibility involved in the role, and the decision should be made with caution, as this person will be held responsible for answering your business's data questions to the Act. They are the official data officers for your organisation. Your business size will give you an idea of how this should be handled. For larger organisations it's better to name an information officer in each department, whereas smaller businesses could manage with only one or two. This decision is entirely based on the amount of data source areas that need to be located and managed within the organisation. Once you have information officers identified, you may then get them to record all data sources they will be responsible for.
Record all data sources
- Step 1: Note down all areas of business (sales, marketing, ops, etc).
- Step 2: Identify each area of data collection or data release within each department (banking, social accounts, suppliers).
- Step 3: Once all areas of data sources are allocated, put them on a list and identify in each data area WHAT information is being shared and WHY, HOW it is being used, and WHO is in charge of this data.
For example: Marketing, Facebook, email, marketing manager. Or: Operations, DHL, client info (name, address, phone), ops manager.
Once you have identified all the above information for your whole organisation, you will have a very clear diagram of the data collected, why, and how it is stored and used within your organisation. This will also allow you to identify any weak points that need to be looked at, or areas that are not protecting your clients or your data.
POPI Act Company Policy
Once all this is identified, your business will be able to draw up a POPI policy, which is part of the POPI Act regulations. This is a detailed document that outlines how data is stored and kept safe within the company, including backups of data. It should be easy to draw up after completing the diagram of all data points within the business. This document is to be sent to all your clients and suppliers, so that they are aware of how their data is being used.
Website
It's important to display your POPI policy on your website via your Privacy Policy page. This ensures you're protected with the right to access policy. This is where all international sites look for this kind of information.
Register on the POPI website
Once you have all the above together you can begin the process of registering and ensuring you're compliant with SA's privacy act here: justice.gov.za/inforeg/portal
The POPI Act was put in place in July 2020, with one year to comply, hence why POPI is trending. Do not panic if you missed the deadline. Please do go ahead, register and complete the process, to ensure no future penalties.
Should you decide not to register your business with the Information Regulator, we highly suggest you ensure you have a Privacy Policy page on your website, or that you send a basic privacy policy document to all clients and suppliers. Should you still have questions, or want to add a privacy policy page to your website, please email us at info@blogaboutbusiness.online for a free assessment.
For in-depth information on the POPI Act, please read popia.co.za.