The signing into law of the Protection of Personal Information (Popi) Act No 4 of 2013 last month is a significant step towards facilitating cross-border trade for the South African economy, but many companies are largely unprepared, as they underestimate the gravity and complexity involved in becoming compliant, says international consultancy Deloitte Legal director Dean Chivers.

The Act will affect nearly every area of business processes and will require, besides other stipulations, amending legal documents, consolidating data views, analysing subcontracting practices and gaining control over cross-border data flows, notes Deloitte Legal senior manager Daniella Kafouris.

“Understanding where data will be hosted and the mechanism used to secure the data are two elements that must be considered, as they will impact on the privacy or Popi compliance of a business,” she says.

“The timeframes involved cannot be underestimated – especially those companies doing business in multiple jurisdictions. They will no longer be able to outsource data storage functions to service providers in countries that do not have data protection laws similar to Popi without implementing sufficient contractual and risk-mitigating measures. These measures will need to be standardised across jurisdictions through binding corporate rules,” warns Chivers.

However, the legislation will benefit cross-border trade.

“Not only is the protection of data a requirement of King III, but the new legislation will also bring South Africa in line with best practices in other parts of the world that enforce commitment to good corporate and data governance,” says Kafouris.

Like other countries, South Africa remains vulnerable to the threat posed by hacking and cybercrime, mostly conducted to gain access to personal information or systems that house personal information.

Complying with Popi is essential to doing business in a data-driven world and has tangible benefits for profitability and competitiveness, as a company that is compliant has an early competitive advantage.

“Companies can start by conducting a gap analysis to identify vulnerabilities and then craft a roadmap to eventual Popi compliance. In the case of multinationals and larger companies, one year will not prove enough to reach compliance; it could possibly be closer to three years,” states Chivers.

Further, Popi will also empower the average citizen by strictly enforcing the way in which an individual’s personal information is stored and distributed. Individuals will have a legally enforceable right to privacy and they will have recourse to legal action if this is not respected.

“Whereas previously such data could be freely passed on and sold between com- panies – ranging from banks to tele- marketers – the consumer will be able to report cases where their personal data has been handed over without their consent,” says Kafouris.
“Data is a company asset – that is why it is so important to control the way in which it is used and stored.”

Ultimately, this legislation will prove an invaluable tool to ensure the integrity, security and privacy of a company’s data – empowering not only the company, but also the ordinary citizen, she concludes.