Ovations Group - Introducing the Protection of Personal Information (PoPI) act and achieving compliance
- 3. DO YOUR POLICIES AND PROCEDURES ENABLE DATA PRIVACY?
- 4. DID YOU KNOW: THE PROTECTION OF PERSONAL INFORMATION (POPI) ACT WILL HAVE AN IMPACT ON ALMOST EVERY COMPANY OPERATING IN SA?
- 5. THE POPI ACT WILL ESTABLISH A CODE OF CONDUCT FOR CONFIDENTIAL HANDLING OF PERSONAL INFORMATION
- 6. 7 CONDITIONS FOR LAWFUL PROCESSING OF PERSONAL INFORMATION Collection of data Processing limitations Retention of data Deletion of information Data security Data subject participation Notification
- 7. COLLECTION OF DATA Information must be collected directly from the individual Exceptions: – Public records – Consent given to a third party – Law enforcement
- 8. COLLECTION OF DATA The person must be aware of the purpose for collecting their personal information and give consent There is additional consent needed to store and process data outside of South Africa
- 9. PROCESSING LIMITATIONS Businesses are not permitted to process personal information of children under 18
- 10. PROCESSING LIMITATIONS Unless specifically permitted, you are NOT ALLOWED to process information about… Religious or philosophical beliefs
- 11. PROCESSING LIMITATIONS Unless specifically permitted, you are NOT ALLOWED to process information about… Trade union membership or political opinions
- 12. PROCESSING LIMITATIONS Unless specifically permitted, you are NOT ALLOWED to process information about… Health, sexual life or biometric details
- 13. PROCESSING LIMITATIONS Unless specifically permitted, you are NOT ALLOWED to process information about… Race or ethnic origin
- 14. PROCESSING LIMITATIONS Unless specifically permitted, you are NOT ALLOWED to process information about… Criminal Behaviour
- 15. RETENTION OF DATA Information must NOT be kept any longer than is necessary for processing
- 16. DELETION OF INFORMATION Data must be destroyed as soon as possible It must be impossible for data to ever be recovered or reconstructed
- 17. DATA SECURITY Technical and organisational security measures to prevent data loss or damage, or unlawful access to personal information are essential.
- 18. DATA SUBJECT PARTICIPATION A person must be able to: Find who has their data Request a copy of all personal information held by an organisation Request amendments or deletion of their data, and receive proof this has been done ****** ****
- 19. ENFORCEMENT Official complaint process Punishment up to 10 years imprisonment and/or fine up to R10 million Civil action may also be taken
- 21. OUR APPROACH We can help you define a strategy and roadmap to become compliant with the POPI Act. We provide a complete and holistic execution that interweaves the key areas of PEOPLE PROCESSES TECHNOLOGY
- 22. PROCESS DIAGRAM Our transformational approach focusing on enablement of people, process and technology. INSIGHT • • • • People understanding Skills and capacity Process capability Technology availability and capability Current state TRANSFORMATION ROADMAP Design the business response to ensure effective and efficient compliance POPI vision and strategy ENABLEMENT Prioritised investment route map based on business and IT considerations in support of defined architecture People education Process compliance Technology capability
- 23. PROCESS DIAGRAM Our transformational approach focusing on enablement of people, process and technology. INSIGHT • • • • People understanding Skills and capacity Process capability Technology availability and capability Current state TRANSFORMATION ROADMAP Design the business response to ensure effective and efficient compliance POPI vision and strategy ENABLEMENT Prioritised investment route map based on business and IT considerations in support of defined architecture People education Process compliance Technology capability
- 24. PROCESS DIAGRAM Our transformational approach focusing on enablement of people, process and technology. Current state Status of Enablement Business and compliance risks POPI vision and strategy Business architecture Information systems architecture Technology architecture People enablement People education Process compliance Technology capability Business and risk considerations Costs and time considerations
- 26. STRATEGY POPI Strategy and Implementation Roadmap Business case development
- 27. TRAINING AND EDUCATION POPI Act and Implications customised for implemented solutions
- 28. CHANGE & COMMUNICATION Strategy & Planning Development & execution of awareness campaigns
- 30. PROCESS & CONTENT Process Solution Design & Automation Records Management assessment, design & enablement Security policy enablement Content archival solutions Content Governance Document destruction services
- 32. LET US HELP YOU BECOME COMPLIANT Ovations is equipped to transform your business to comply with the Protection of Personal Information Act.