POPIA & Device Security
your compliance questions answered
i. What POPIA requires
POPIA includes a number of stated conditions, and each must be fulfilled in order for an organisation to remain in compliance with the law. POPIA's provisions require the Responsible Party to define the purpose for which they collect personal information, and inform the individual of what that purpose is.
POPIA is the South African Protection of Personal Information Act which regulates the processing and handling of Personal Data by a business or entity.
The Information Regulator regulates POPIA (https://inforegulator.org.za). Parliament has gone to great lengths to give this regulator teeth. There are significant consequences for non-compliance.
Of these, reputational damage is likely the biggest risk and most potentially harmful to an organisation.
II. How POPIA affects south african businesses and organisations?
POPIA sets conditions that any organisation processing personal information must comply with. Under POPIA, organisations in South Africa are required to protect the personal information they process.
Some organisations will require special permission from the regulator for processing certain types of information as defined by the Act.
Yes, virtually everybody. POPIA applies to anyone who processes personal information. It applies to all public (like Municipalities and SARS) and private bodies (like financial institutions, healthcare providers and direct marketers).
Yes, you must comply with POPIA (and the consequences for non-compliance are quite severe). While this is the case, you do want to adhere to the law efficiently and get business value from your efforts.
If you have decided to process personal information in a certain way, then you are the responsible party. The responsible party is the person that, alone or in conjunction with others, determines the purpose of and means (the why and the how) for processing personal information.
III. What POPIA mean to you as the custodian of personal information
The conditions for lawful processing under POPIA apply even if personal information is public knowledge.
Yes, it does. You may have already been securing the information that you hold because it made business sense to do so. POPIA now places a legal obligation on you to secure the information you process. You must secure both the integrity and confidentiality of any personal information by taking appropriate, reasonable technical (such as using encryption) and organisational (such as policy) measures to prevent loss and unlawful access (hacking).
Yes, because it is a key technical measure for securing data. Encryption is the first line of defence for sensitive data and is a key aspect of complying with POPIA. However, encryption is often not fully sufficient on its own. For example, if somebody knows or hacks a password they can bypass the encryption.
Yes. Although POPIA does not explicitly deal with email encryption, it does require you to take security measures that are appropriate and reasonable in relation to the nature of the personal information you process. If you send an email that contains personal information of such a nature that data subjects could suffer adverse harm if the email were hacked, it would be appropriate and reasonable to ensure that it is encrypted. The regulator would not look kindly on you if you were to send it unencrypted. Further to this point, data protection authorities around the world recognise encryption as one of the generally appropriate and reasonable security measures that you must take.
You as a responsible party must protect the personal information of your data subjects when the data is transferred to a third party in another country. The other country may not have the same level of data protection as your country.
IV. Practical Guidance on POPIA and how to comply
No, you do not have to notify the information regulator or the data subjects, because an unauthorised person is unlikely to have accessed the personal information. There are three key elements to SMBsecure that make this happen:
Yes, Memory sticks are high risk because people can copy large amounts of personal information onto them and they be easily lost or stolen because they its small size and portability. SMBsecure can do port blocking and when using the Premium service it can also protect the data on a memory stick the same way it does with other mobile devices, but provides protection and traceability beyond just creating an encryption vault; spanning functions including access control to rights management.
Yes. Email encryption is one of the ways to protect data subjects from harm and further comply with POPIA. The neat and simple SMBsecure plugin for Outlook on PC can help you to accomplish end-to-end encryption for personal data being emailed and provides sufficient features and functions to accommodate most requirements.