Towards a privacy compliance assessment toolkit

Abstract

The South African Protection of Personal Information (POPI) Act No.4 of 2013 makes it illegal to collect, use, process or store personal information unless it is done in accordance with the prescribed legal and regulatory clauses enriched in the Act. Organizations should take stock of the personal information they collect and who they share it with before they can put controls in place to safeguard it. Failure to comply with POPI Act may potentially expose the responsible party and its associated third parties to steep legal penalties including possibly imprisonment of up to 10 years or R10 million fine which is imposed by the Information Regulator of South Africa. This paper presents the results of a system called Protection of Personal Information Act Compliance Assessment Toolkit (PCAT). The main aim of this system is to assist organisations to assess their current state of compliance to the POPI Act. The PCAT solution followed an experimental research and development process, where three existing similar technologies in the market were analysed and compared to the PCAT. The results of the PCAT shows that it simplifies the POPIA compliance requirements compared to the other three existing technologies. Future work will include development of executive summary report which will make it easier for executive to view the compliance assessment in a high-level format.