Almost every business system holds personal information: employee records, client contacts, learner files, patient details or delivery addresses. In South Africa that brings the Protection of Personal Information Act (POPIA) into every software decision, whether you buy a product or build your own.
POPIA came into effect on 1 July 2020, and organisations had until 30 June 2021 to comply. This checklist covers the questions to ask about any system that will hold personal information.
This article is general guidance, not legal advice. For decisions about your specific obligations, consult a qualified data protection practitioner.
The eight conditions in brief
POPIA sets eight conditions for processing personal information lawfully: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. Each condition has practical consequences for how a system should be designed.
1. Know what personal information the system will hold
Start with a simple inventory: which fields are personal information, whose information it is, and why each field is needed. Collect only what the purpose requires. A field that is never used is a risk with no benefit.
Pay particular attention to special personal information, which POPIA treats more strictly. It includes information about health, religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, sex life, biometric information and criminal behaviour.
2. Control who can see what
POPIA requires appropriate, reasonable technical and organisational measures to protect personal information. In a business system that starts with access control:
- Role-based access, so each person sees only the records their role needs.
- Permissions enforced in the database or server, not only hidden on screen.
- Two-factor authentication for administrators and anyone with access to sensitive records.
- An audit log recording who viewed or changed personal information, and when.
3. Check every operator that processes data for you
A software vendor, hosting provider or developer that processes personal information on your behalf is an operator under POPIA. You remain responsible as the responsible party, and POPIA requires a written contract that obliges the operator to maintain appropriate security measures.
For every vendor, ask: what do they do with the data, where do they store it, who on their side can access it, and will they notify you promptly if something goes wrong?
4. Know where the data is hosted
Many cloud products store data outside South Africa. POPIA allows personal information to be transferred across borders only under certain conditions, for example where the recipient is subject to a law, binding corporate rules or an agreement that provides an adequate level of protection, or where the person has consented. Find out where each system stores its data and confirm the transfer basis before you sign.
5. Plan retention and deletion
Personal information should not be kept longer than necessary for the purpose it was collected for, unless a law or contract requires it. A good system lets you set retention periods by record type, and delete or de-identify records when those periods end. If a product cannot delete data properly, that is a red flag.
6. Support data subject requests
People have the right to ask whether you hold their personal information, to see it, and to ask for it to be corrected or deleted. Your systems should make it straightforward to find everything held about one person and to export or correct it, without a manual search across spreadsheets and inboxes.
7. Be ready for a security compromise
If there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, POPIA requires you to notify the Information Regulator and the affected people as soon as reasonably possible. Before a system goes live, agree who will decide, who will notify, and how the vendor will tell you about an incident on their side.
8. Keep marketing consent separate
Direct marketing by electronic communication, such as email or SMS, generally requires consent from people who are not existing customers. If a system sends marketing messages, it should record consent and opt-outs, and keep them separate from the operational records the system needs for its main purpose.
Do not forget the Information Officer
Every organisation has an Information Officer, by default the head of the organisation, who is responsible for POPIA compliance and must be registered with the Information Regulator. That person should be involved when a new system that holds personal information is chosen or built.
Key takeaways
- Inventory the personal information a system will hold, and collect only what you need.
- Enforce role-based access in the system itself and log access to sensitive records.
- Put a written operator agreement in place with every vendor that processes your data.
- Confirm where data is hosted and the basis for any cross-border transfer.
- Make sure the system supports retention, deletion and access requests.
POPIA compliance is much easier to design into a system at the start than to add once it is full of data.
Our technology consulting work includes reviewing how a proposed system handles personal information, and the business systems we build use role-based access enforced in the database, audit logging and agreed hosting from the start.
