A handy checklist to ensure compliance!

This handy checklist provides a proven step-by-step forty-action-point approach to compliance.

1. Formalise your POPI Act compliance project.

• Identify your relevant stakeholders;
• Identify your project sponsor;
• Identify your project manager;
• Set high level scope, timescale, budget.

2. Appoint an Information Officer.

• Ensure alignment between your Promotion of Access to Information Act (PAIA) and POPI Information Officer (IO);
• Decide whether the CEO can fulfill the IO function or needs a Deputy/Deputies (DIO);
• Agree IO/DIO roles and responsibilities and
• Complete the formal appointment process.

3. Perform a gap analysis versus the POPI Act.

• Set interim and final targets for compliance with the POPI Act. This does not mean slavishly shooting for 100% regardless of costs and benefits!
• Engage with stakeholders in the assessment
• Use an evidence-based approach
• Use the assessments for ongoing compliance monitoring

4. Analyse what and how Personal Information is processed.

• Use a broad definition of record types as per the POPI Act (e.g. CCTV, biometric);
• Look at various aspects as required by the POPI Act (including consent, purpose, source, sharing, destruction);
• Consider user rights and their management;
• Think broadly in terms of the types of devices where data is stored – and represents a security compromise risk.

5. Implement POPI Act compliance policies.

• Review existing relevant policies;
• Ensure your policies are reasonable and appropriate;
• Make sure your policies are enforceable;
• Design your Privacy Notices for diverse stakeholder groups.

6. Review your web sites.

• Develop your checklist of what to review;
• Agree the rating scheme to be used;
• Use the opportunity to implement “best practice” such as Cookie notifications;
• Develop and implement your remediation plan.

7. Update / create your PAIA manual.

• Confirm your organisation needs a Promotion of Access to Information Act (PAIA) manual and by when;
• Confirm whether you are a Public or Private Body as per the PAIA;
• Review the proposed contents of your manual;
• Ensure your PAIA manual follows the prescribed layout and includes the necessary details.

8. Implement POPI compliant PI management processes.

• Look at the PI lifecycle: including acquisition, processing, retention, and destruction practices;
• Develop reasonable and appropriate measures to ensure ongoing compliance;
• These could include self-assessments, health-checks, formal audits
• Develop your dashboard for compliance.

9. Train stakeholders about their roles in POPI Act compliance.

• Design training according to their needs;
• Ensure you treat user education not as a once-off series of activities but part of an ongoing commitment;
• Leverage diverse training methods, including self-study, online, classroom, audio and video;
• Look to special needs such as the IO/DIO roles.

10. Make POPI Act compliance “Business-As-Usual”

• Recognise that POPI Act compliance will be the “new normal” and work that way;
• Build compliance into your products, services and processes – adopt “Privacy By Design”;
• Ensure ongoing monitoring of the data protection / POPI ecosystem – legislation, regulations, opportunities and threats;
• Build POPI into your everyday operations – make POPI “Business-As-Usual”.