Subscribe & Follow
Trending
Elections 2024
Jobs
- Cybercrime Specialist Cape Town
- Security Specialist Cape Town
3 simple steps to kickstart your POPIA compliance
In a 2019 survey conducted by Sophos, only 34% of South African organisations are reportedly ready to comply with POPIA. And complying with data privacy, security laws and regulations can be a daunting task for any organisation. Especially since requirements are vague and ambiguous, with little specific guidance as to how to achieve compliance.
So where should you begin? Here are three simple steps to help you get started:
- Start with a Business Privacy Impact Assessment
Condition 7 of the Act (“Security Safeguards”), requires organisations to take “appropriate and reasonable measures” to safeguard personal information. The concept of acting “reasonably” is used in many privacy laws all over the world and requires a business to do what is appropriate to protect its data. Note that this does not require perfection. Rather, the business must take a risk-based approach and do what is reasonable to mitigate that risk.
By conducting a business privacy impact and risk assessment, you’ll identify privacy risks in your organisation and come up with a plan to either remediate or accept them.
- Prioritise your high risk processes
High-risk processes should always come first. Start with client/customer personal data and work your way towards employee personal data. This will involve collaboration with many departments, so executive buy-in is a must; and privacy compliance should be pitched as business enablement.
- Drive a Privacy & POPIA Awareness Campaign
Employees need to be made aware of and get trained in the security requirements of the organisation as well as learn about the basic POPIA privacy principles and how to apply these at work. Security awareness training for employees is one of the most effective means for reducing the potential for costly errors in handling sensitive information and protecting company information systems.
The new requirements around POPIA and other regulations can seem tedious, but there are plenty of resources to assist with training around POPIA, GDPR and other privacy and cybersecurity content.
KnowBe4 Africa is offering a new training course on POPIA. Just remember these three simple steps when you’re looking to comply with POPIA.