It has been a requirement to comply with the POPIA Act since 30 June 2021. What does that mean in practical terms?<\/p>\n
The Act kicks in the moment you collect, store or process the personal information (PI) of either natural persons or juristic persons (e.g. an organisation), also known as data subjects. This also affects information obtained in the past \u2013 in other words, historic records.<\/p>\n
The one-two-three of becoming POPIA-compliant is: Assess<\/em>, Act<\/em> and Train<\/em>.<\/p>\n Assess<\/em>: Start by assessing what PI is collected, stored or processed: Where is info handled? Which of it is relevant PI? Which of such PI qualifies as an exception? Destroy any info that you don’t need, and secure the rest.<\/p>\n Act<\/em>: Get historic consent for existing records; check that you are correctly processing all info; interrogate your own safeguards, e.g. IT and physical safety measures; put in place a system to notify data subjects in future that their info will be processed, and to get their consent beforehand; and create a system to protect PI once it has been obtained. This includes drafting internal policies and procedures, installing IT safeguards, introducing attack alerts, and carrying out regular attack testing scenarios.<\/p>\n Train<\/em>: All staff should be trained to obtain the minimum of information from any data subjects they deal with. They shouldn’t ask for any info that is not needed, such as whether a data subject is married or how many children they have, unless that information bears directly on the relationship with the customer or client. An organisation should be able to give valid reasons for any item of information that they collect. Staff should also be educated on the rights of data subjects, so that they will not unknowingly breach such rights and compromise the organisation.<\/p>\n There are a number of other general aspects as well to consider in becoming and remaining POPIA-compliant:<\/p>\n Any handling of data subjects’ PI requires stringent rules and procedures. Past as well as future records must be subject to systems that protect the relevant information, and all staff must be trained to keep the organisation compliant.<\/p>\n It has been a requirement to comply with the POPIA Act since 30 June 2021. What does that mean in practical terms?<\/p>\n The Act kicks in the moment you collect, store or process the personal information (PI) of either natural persons or juristic persons (e.g. an organisation), also known as data subjects. This also affects information obtained in the past \u2013 in other words, historic records.<\/p>\n","protected":false},"excerpt":{"rendered":" It has been a requirement to comply with the POPIA Act since 30 June 2021. What does that mean in practical terms? The Act kicks in the moment you collect, store or process the personal information (PI) of either natural persons or juristic persons (e.g. an organisation), also known as data subjects. This also affects […]<\/p>\n","protected":false},"author":3,"featured_media":104080,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[32],"tags":[],"class_list":["post-150132","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-legislation"],"yoast_head":"\n\n
Takeaway<\/h2>\n