As a business owner, your operational concerns include security and the protection of personal information. The Protection of Personal Information Act or POPIA, came into effect 1 July 2021 and a grace period of 12 months has been given to businesses to comply. Therefore, as of 1 July 2021, all businesses will have to be POPIA compliant. An onus is also placed onto your business’ financial auditing function as non-compliance with any legislation is a reportable matter.

The POPI Act protects data subjects from theft and discrimination and when breached will impact the responsible parties with heavy fines, imprisonment or both. The unlawful and unauthorised use of personal information of individuals is reported to be rising at an alarming rate within the country. Cybercrime and identity theft are serious crimes that pose massive threats to individuals who part with their personal information when dealing with various institutions.

• Most businesses in the public and private sector must comply with the provisions of POPIA
• Revisit your systems that request personal information in order to check that you are compliant
• A business must take ‘appropriate, reasonable, technical and organisational measures’ to prevent the unauthorised access to or loss of personal information.
• Any data breach must be disclosed to the regulator
• An information officer must be appointed by the business to ensure compliance and data processing activities
• Enlisting the help of an outside service provider, such as a law firm, to help your business put in the proper measures, controls and activities needed is a good idea
• Ensure that your business is POPIA compliant by no later than 1 July 2021