If you thought the Protection of Personal Information Act was just a bunch of toothless legal jargon, think again.
Last year the Information Regulator slapped a R5 million fine on the Department of Justice and Constitutional Development for failing to protect personal information following a ransomware attack. More recently it issued an enforcement notice to training institution FT Rams Consulting for contravening various sections of POPIA.
The message being sent to businesses is clear – get your house in order or face the consequences, which can be harsh.
The POPI Act ensures everyone’s right to privacy and protection against the misuse of personal information, says Nicol Myburgh, Head: HCM Business Unit at CRS Technologies. “It covers all personal information, including details of employees, suppliers and clients.
“Failure to adhere to the legislation could result in substantial penalties, ranging from fines of millions of Rands for serious offences to incarceration of up to ten years. This is over and above the potential reputational damage from information breaches, which may lead to legal action and even business downfall.”
Becoming POPIA compliant is a complex undertaking, he continues. “Organisations must not only restrict how they collect, process, store and share personal data, but are also legally obliged to safeguard its privacy.”
But rather than view POPIA as a regulatory burden, Myburgh says businesses should approach it as an opportunity to simplify, review and streamline their processes. This is where CRS offers a valuable service.
“As an established HR and payroll solutions and services provider, we understand the importance of complying with legislation while protecting the integrity and confidentiality of sensitive data.
“We help business owners conduct a thorough analysis of the personal information within their organisation, develop and implement appropriate data privacy policies, and establish robust data security practices.
“Additionally, our systems are geared to not only comply with POPIA, but also the General Data Protection Regulation (GDPR), which means we can also assist businesses operating in Europe.”
Myburgh urges business owners not to wait to fall foul of POPIA’s requirements before taking action. “We operate in an increasingly privacy-conscious business environment. Proactively engaging with data privacy, and transforming it from a legislative necessity into a strategic advantage empowers organisations to build trust and stay ahead of the curve.”
