POPIA, PAIA & Cyber Risk: Why Privacy Is Now a Board-Level Issue
South African boards can no longer treat privacy compliance as an IT responsibility. Here’s what directors should be asking — and why evidence of compliance matters.
Gilles van de Wall
Privacy compliance is no longer only an IT function. POPIA compliance is a governance issue because data failures create legal, operational, reputational and client-trust consequences.
The Protection of Personal Information Act 4 of 2013 requires responsible parties to secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures.1 Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, notification duties may arise.2
Boards must ask operational questions
A board should not be satisfied with the statement that the company is POPIA compliant. It should ask what evidence supports that statement.
Who is the Information Officer and have deputies been appointed where needed?
Is there a current personal-information inventory?
What security safeguards are in place?
When was the last incident-response test?
Are operators and service providers contractually bound?
How are PAIA requests received, logged and answered?
PAIA is part of governance too
The Promotion of Access to Information Act gives effect to the constitutional right of access to information and imposes duties on public and private bodies in relation to access requests and manuals.3 Poor PAIA processes often expose weak governance long before litigation begins.
Regulatory enforcement is a warning
Recent Information Regulator enforcement activity shows that POPIA and PAIA failures can affect both public and private organisations.4 Boards should treat this as a reminder to build evidence of compliance before a complaint or breach occurs.
The client takeaway
Privacy governance is not a policy pack sitting in a folder. It is a living control system: roles, registers, security, training, supplier management, incident response and proof. If the board cannot see the evidence, the compliance may not exist in any meaningful way.
Build Well. Govern Wisely. Build With Confidence.