The POPI readiness questionnaire scores your readiness for POPI compliance and implementation. It is not an assessment (Personal Information Impact Assessment), but merely the first step in the process in POPI compliance.
It is important to perform your readiness survey because it determines your readiness for POPI implementation through 4 different modules; governance, people, procedure and technology. It will give you an overview of your POPI readiness.
No, it is not. It is valuable because it gives you an overall determination of your POPI readiness, but it in not compulsory in terms of the Act.
A Personal Information Impact Assessment (PIIA) is a process to help you identify and minimise the data protection risks from processing personal information.
Yes, according to the POPIA regulation 4(b) you are required do
Personal Information Impact Assessment (PIIA) for all processing of personal
information.
This is the party or person who takes responsibly for complying with and implementing any policies or procedures in terms of the function on behalf of the business.
Special personal information is
defined in terms of Section 26 of the Act. Special personal information
includes, a data subject's:
- Race
- Sex
- Pregnancy
- National, ethnic or social origin
- Colour
- Sexual orientation
- Physical or mental health, well-being or disability
- Religion, conscience, belief or culture
- Medical history
- Criminal history
- Biometric information
- Trade union membership
- Political persuasions
Sensitive personal information
is information that can identify the data subject. This can include information
such as the data subjects: ID numbers (Individuals) , Bank Account details
(Individuals or Juristic e.g. companies) and Tax Numbers (Individuals or
Juristic e.g. companies).
The lawfulness of processing personal information must be determined using all 8 pillars of lawful processing in terms of POPIA. The 8 pillars for lawfully processing personal information are:
a. Accountability
b. Processing limitation
c. Purpose specification
d. Further processing limitation
e. Information quality
f. Openness
g. Security safeguards
h. Data subject participation
Personal information may not be processed without consent unless any one of the factual scenarios in section 11 of POPIA is applicable. If any of the factual scenarios is present, consent is not needed. The factual scenarios include if:
1. it is required to conclude or perform the contract;
2. the party processing the information (the responsible party) is required to do so ‘by law’;
3. the processing protects a legitimate interest of the consumer;
4. the processing is necessary for the performance of a ‘public law duty’; or
5. it is done in pursuit of the legitimate interests of the responsible party.
This is the risk that is
inherent to a specific function and sub process and is measured before
taking control measures into account.
If Personal Identifiable
Information (PII) were to be lost in that specific sub process it might have a
Critical, High, Medium or Low impact.
Where the volume of PII is low
and the type of personal information is not sensitive or special personal
information is not processed the Inherent risk might be low.
Where the volumes of the PII
is high in a sub process and there is sensitive and special personal
information are processed in that sub process the Inherent Risk might be
Critical.
The residual risk is the risk
that remains after the control measures have been taking into account.
If there are no control
measures in place the Residual Risk will be the same as the Inherent Risk.
The more control measures that
are in place the higher the impact on the residual risk that remains. There
might be a High Inherent Risk but because of the control measures the Residual
risk is Medium.
The Residual risk is the one
that an organisation can control by adding control measures. The Residual Risk
should always be at an acceptable level for an organisation. If it is to high
more control measures should be added.
A critical indicator would show when
either inherent, residual, or behavioural risk is defined as Critical. This
means one of the risk indictors shows an issue with the information captured or
shows a potential problem with your processes and requires immediate focus.
If your Inherent risk is Critical, this means your company holds a high volume of
personal information some of which may relate to GDPR members or children.
Typically, there is nothing that can be done
to resolve this, but it may help to check retention periods of documents as
stated on retention policy as well as ensuring your residual risk is lower and
shows your control measures are sufficient.
If your residual risk is critical, this indicates a huge issue and immediately action is required to safeguard
the information in your possession by applying control measures.
If your behavioural risk is critical, this may mean you are not complying to seven pillars of lawful
processing. This should be investigated, and measures taken to ensure you take
these several measures into account in your company’s processes.
These are the steps given on the Information Regulators website.
Download the Registration form you need
HERE
You will need to add staff to complete the following
actions:
·
Assign action items from your action plan;
·
Allocate departments in your impact assessment;
·
Add them to the minutes of meetings;
·
Record all training conducted;
·
Send them links to training videos.
Processing of Personal
Information must be performed with a specific purpose in mind of which the data
subject must be aware.
The retention, time periods and restriction of
information must also be taken into consideration. Thus, data cannot be
collected or processed for one specific and defined purposes and used for another
purpose without the data subjects consent.
Processing of personal
information must be performed with a specific purpose in mind of which the data
subject must be aware.
The retention, time periods and restriction of
information must also be taken into consideration.
Thus, data cannot be
collected or processed for one specific and defined purposes and used for another
purpose without the data subjects consent.