IT Governance & Risk Management

Requirement: Personal data must be protected by appropriate security measures (encryption, access controls, firewalls).

Example Violation: Storing customer credit card details without encryption in unprotected spreadsheets.

Action: Implement encryption for sensitive data. Use strong passwords, multi-factor authentication, and limit file access.

Requirement: If you share personal data with third parties (cloud providers, payroll services, etc.), you must have written agreements (Data Processing Agreements).

Example Violation: Uploading employee records to a cloud service without a written DPA with the vendor.

Action: Identify all third parties who access personal data. Obtain signed Data Processing Agreements from each.

Requirement: You must only keep personal data as long as necessary and delete it when no longer needed.

Example Violation: Keeping job applicant records for 10 years after they're rejected, or customer data after they've stopped doing business.

Action: Create a data retention schedule. Document how long you keep each type of data and why. Implement automated deletion where possible.

Requirement: Individuals have the right to request what personal data you hold about them. You must respond within 15 days.

Example Violation: Ignoring a customer's request to see their personal data or taking 3 months to respond.

Action: Create a documented process for handling data access requests. Designate responsibility and set up a tracking system.

Requirement: If personal data is breached, you must notify the Information Commissioner and affected individuals as soon as reasonably practicable.

Example Violation: Not reporting a data breach where customer emails were exposed in an unsecured server.

Action: Create an incident response plan. Identify who will handle breaches and establish a communication template for notifications.

Requirement: Your team must understand POPIA requirements and how to handle personal data responsibly.

Example Violation: An employee sharing customer data on social media or discussing client details in public.

Action: Conduct annual POPIA training for all staff. Document attendance and maintain training records.

Requirement: Only collect personal data that's necessary for your stated purpose.

Example Violation: Asking for a customer's ID number when you only need their email for a newsletter.

Action: Review all forms and systems. Remove any non-essential data fields or make them optional.

Requirement: Use personal data only for the purpose stated when you collected it.

Example Violation: Collecting email "for password resets only" then using it for marketing without new consent.

Action: Document the purpose for each data collection point. Get fresh consent if you want to use data for new purposes.

Requirement: Keep personal data accurate, complete, and up to date.

Example Violation: Sending invoices to old addresses when updated contact info is available.

Action: Implement a data quality process. Allow customers to update their information and verify data periodically.

Requirement: Maintain a record of all personal data you hold: what, where, why, for how long, and who has access.

Example Violation: Not knowing what customer data you have or where it's stored across your company.

Action: Create a data inventory spreadsheet listing all databases, systems, and cloud services storing personal data.

Requirement: Individuals can request deletion of their data if it's no longer needed.

Example Violation: Refusing to delete customer records when requested without a legal reason to keep them.

Action: Create a documented process for handling deletion requests. Ensure you can actually delete data from all systems.

Requirement: Individuals must opt-in to marketing communications and can easily opt-out.

Example Violation: Sending marketing emails to customers who never consented or making unsubscribe difficult.

Action: Include clear unsubscribe links in all marketing emails. Maintain an opt-out list and respect requests immediately.

Requirement: Only authorized staff should access personal data. Use permissions, user roles, and audit logs.

Example Violation: Giving all employees access to the entire customer database or using shared login credentials.

Action: Implement role-based access. Give employees only access to data they need. Enable audit logging for access.

Requirement: Regularly audit and monitor third-party vendors handling personal data to ensure they're compliant.

Example Violation: Using a cloud provider without verifying their security practices or checking their data center location.

Action: Maintain a vendor list. Request their compliance certifications and conduct periodic security reviews.

Requirement: Before launching new systems or processing activities, assess privacy risks and mitigation measures.

Example Violation: Implementing employee monitoring software without considering privacy implications or staff consent.

Action: Create a simple PIA template. Use it before deploying new tools, CRM systems, or processing activities.

Requirement: Keep detailed records proving you're compliant (policies, training logs, consent records, audit trails).

Example Violation: Being unable to prove you got consent from a customer or demonstrate your data security measures.

Action: Create a compliance folder with all key documents: policies, DPAs, consent records, training attendance, and incident logs.