“Risk comes from not knowing what you’re doing.” Warren Buffet

To comply with POPIA, companies should: appoint dedicated compliance leads, figure out how information flows through the business, review policies, get proper consent from customers, have valid reasons for using people’s information, put good security controls in place, give people access to their information upon request, only keep information as long as necessary, properly train staff, regularly check compliance and do comprehensive impact assessments for high-risk information processing activities. Following POPIA is an ongoing responsibility and requires real commitment to privacy governance. 

Companies can ensure compliance with POPIA by following these steps:

• Appoint an information officer and register them with the Information Regulator. 
• Determine how information flows through the company.  
•  Review company policies on data protection, or develop policies if they are not available. 
• Ensure that there are valid reasons for using personal information, and get consent when the law requires it.
•  Only keep personal information if it is required, and give people access to their information if they request it.
• Put good security controls in place and do comprehensive impact assessments for high-risk processing activities. 
• Ensure that staff is trained, and regularly check compliance with POPIA.

Remember that compliance is an ongoing responsibility and requires a commitment to good privacy governance.