RISKS

Section 19, of the Act marks a drastic departure from the current largely unregulated IT security landscape in South Africa.

POPIA legislates the creation and maintenance of a risk register specifically to:

1. identify potential risk that affect processing of personal information in business.
2. Review it regularly,
3. Verify and update responses to identified risks by taking appropriate, reasonable technical and organisational measures as ell as measures for outsourced service provider to protect personal information.
4. Corrective and Preventative Actions.

Businesses are now additionally compelled to:

• Record and
• Address, the various risk factors giving rise to cybercrime

Companies that gather, receive, hold, use or share information about a consumer or business customer are now affected by POPIA

In addition, section 21, indicates that Businesses must establish and maintain the security measures, where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the outsourced service provider must notify the business immediately, hence, both the business and the outsourced service provider requires the continued application of resources and effort to ensure that personal information is protected and processed lawfully as intended by the Act.