POPI Act Training

POPI Act training courses available via Zoom

Overview of POPI Act

COMPLYING WITH THE REQUIREMENTS FOR THE PROTECTION OF PERSONAL INFORMATION

Privacy is the constitutional right of everyone in South Africa and is entrenched in the "Bill Of Rights". The Protection of Personal Information Act gives effect to this constitutional right of privacy by requiring safeguards for personal information processed by public and private bodies. Non-compliance may have serious consequences.

Overview

This 1 day course provides delegates with an overview of the Protection of Personal Information Act and the significant obligations placed on those business leaders identified as the "responsible parties" and "information officers". All public and private bodies will be affected by the requirements of this legislation. Various technical and organisational arrangements will be necessary.

Accountability for something as important as privacy protection and the protection of the organisation’s reputation rightly belongs with the Council and executive managers. Many functions (e.g. Legal, Operations, Information Systems, Public Affairs, Marketing) will need to bring their practices into line to ensure that the organisation’s response is consistent and serves the organisation’s enterprise-wide goals and strategies.

The collection of personal information must be for a specifically defined, lawful purpose related to a function of the responsible party. The processing of data must be for a legitimate purpose. Data subjects must be aware of the collection of the data. Adequate business controls are required to maintain data integrity and information security must meet international standards. data must be retained only for as long as necessary and then it must be destroyed.

Seminar Objectives

Participants will obtain an overview of the Protection of Personal Information Act and its implications for their organsations. On completion of this seminar, participants will be able to:

  • Articulate the requirements of the Protection of Personal Information Act
  • Demonstrate an understanding of the conditions for the lawful processing of personal information
  • Identify the technical and organisational measurements necessary for protecting personal information
  • Describe the various roles and the responsibilities of the personnel who should be concerned about the protection of personal information
  • Identify the effort required to meet the requirements of the Protection of Personal Information Act and the conditions for lawful processing and personal information contained therein.

Seminar Outline

Participants will learn through discussion and practical examples how to address the organisational, procedural, technical, and legal requirements for the Protection of Person Information.

This seminar includes topics about:

  • Overview of the legislation for the Protection of Personal Information
  • The duties of the Responsible Party and Information Officer
  • Summary of the eight conditions for the lawful processing of personal information
  • Working with the Regulator
  • Communicating with data subjects
  • The eight conditions for the lawful processing of personal information
  • How to differentiate between personal and other data
  • How to update the PAIA manual and what records to keep about the processing of personal information
  • Identifying and mitigating privacy related tasks
  • Organisational and technical arrangements necessary for the protection of personal information
  • Controlling the activities of service providers and operators
  • Trans-border exchanges of personal data
  • Building organisational capability to manage privacy
  • Challenges from the collection, profiling, cross-marketing, unstructured data, third party processing and secondary use of personal information.

Developing a compliance framework to address the obligations of the POPI Act

COMPLYING WITH THE LEGAL REQUIREMENTS FOR THE PROTECTION OF PERSONAL INFORMATION

The Protection of Personal Information Act requires all public and private bodies to ensure that how they use personal information is lawful, that there are systems in place for the protection of personal information, and there are processes for handling requests from the Information Regulator and individuals (i.e. data subjects).

Overview

The Protection of Personal Information Act has been finalised. All public and private bodies are required to record their processing of personal information in their PAIA Information Manual prior to actually processing it.

All public and private bodies are required to ensure that the processing of personal information is lawful and that personal information in their possession is always secure. Failure to do so could have serious consequences and may result in criminal proceedings and civil claims for damages.

The Protection of Personal Information Act specifies eight conditions for the lawful processing of personal information. Regardless of whether the organisation is a large corporate, government department, school or research organisation, it will have to ensure that the processing of personal information is lawful and all personal data in its possession is properly acquired, secured and destroyed when obsolete.

Seminar Objectives

Participants will obtain an understanding of the statutory requirements for the processing of personal Information. On completion of this 2 day seminar, participants will be able to:

  • Demonstrate an understanding of the requirements of the Protection of Personal Information Act
  • Be able to communicate the key aspects of the Protection of Personal Information Act
  • Articulate the activities necessary to address the legal requirements for the Protection of Personal Information
  • Clarify the roles and responsibilities of all parties required to be involved in the protection of personal information
  • Prepare a road map for the protection of personal information
  • Update the PAIA information manual
  • Perform a privacy impact assessment
  • Manage the privacy initiative in their organisation.

Seminar Outline

Participants will learn through discussion and practical examples how to prepare for and address the organisational, procedural, technical and legal requirements of the legislation for the Protection of Personal Information.

 

This seminar includes topics about:

  • The key components of the Protection of Personal Information Act
  • Accountability for the processing of personal information
  • Conditions for lawful processing of personal information
  • Identifying personal information and the category of special personal information
  • Processing that is subject to prior authorisations
  • Trans-border exchanges of personal data
  • Developing a Privacy Policy and educating staff
  • Conducting a Privacy Impact Assessment
  • Contracting with Operators and verifying compliance
  • Building capability to manage Privacy
  • Privacy by Design
  • Managing information throughout its life-cycle
  • The responsibilities of the CEO, the appointed “responsible parties” and appointed “information officer”
  • Records to be maintained in the PAIA information manuals regarding the processing of personal information
  • Handling requests for information and complaints from data subjects
  • The role and responsibilities of the Information Officer
  • The role of the Information Regulator
  • Assessments undertaken by the Information Regulator
  • Civil remedies, enforcement and criminal offences
  • The information security requirements
  • The need for records management and a legal register
  • Maintaining the information quality of personal data
  • Avoiding secondary use and unlawful processing
  • Developing an Action Plan to address the requirements for the lawful processing of personal information.

Protection of Personal Information Act: Impact on HR

COMPLYING WITH THE LEGAL REQUIREMENTS FOR THE PROTECTION OF PERSONAL INFORMATION

The Protection of Personal Information Act requires all public and private bodies to ensure that how they use personal information is lawful, that there are systems in place for the protection of personal information, and there are processes for handling requests from the Information Regulator and individuals (i.e. data subjects).

Overview

The Protection of Personal Information Act requires that responsible parties ensure that any processing of personal information conforms to all eight conditions for the lawful processing of personal information. The processing of human resources (HR) information of job applicants and employees are areas of high-risk.

Privacy is a human right, protected by the South African Constitution. Individuals whose personal data is misused may feel particularly aggrieved that there has been an interference with their individual right to privacy, request the Information Regulator to take action and seek compensation.

Just because you can do something doesn't make it legal. Obtaining consent from employees, most often, is pointless.

Seminar Objectives:

Participants will obtain an understanding of legislative requirements for the processing of personal Information that apply to human resource management.

On completion of this 2 day seminar, participants will be able to:

  • Demonstrate an understanding of the impact of the Protection of Personal Information Act on the processing of HR information
  • Communicate the impact of POPI on HR
  • Prepare a road map for the protection of personal information in the HR
  • Articulate the HR activities that require attention as a result of the Protection of Personal Information Act
  • Clarify responsibilities of HR personnel involved in the processing of personal information function
  • Develop a privacy impact assessment for HR information
  • Perform a risk assessment for HR data.

Seminar Outline

Participants will learn through discussion and practical examples how to prepare for and address the organisational, procedural, technical and legal obligations for processing human resources information in conformance with the protection of POPI Act

This seminar includes topics about:

  • Why the protection of personal information is important for human resource management
  • The key components of the Protection of Personal Information Act
  • Accountability for the processing of personal information
  • Conditions for lawful processing of personal information
  • Identifying personal information and special personal information processed within HR
  • The impact of the POPI Act on the terms and conditions of employment
  • Good privacy practices of the HR function
  • Common HR practices that do not comply with the Protection of Personal Information Act
  • Restricting HR personnel's access to personal data
  • Risks from photocopying, faxes, and emails
  • Securing employee information in the office, when being transported and processed at employee's homes
  • Keeping only what is allowed
  • Risks from using social media
  • The requirements for exchanging personal information
  • Staff data portability
  • Sharing employee data within a Group of companies
  • The cost of assurance.

Protection of Personal Information Act: Obligations of Responsible Parties

CEOs AND BUSINESS LEADERS ARE RESPONSIBLE FOR ENSURING THE PROCESSING OF PERSONAL INFORMATION IS LAWFUL

Responsible parties – those individuals who, alone or in conjunction with others, determine the purpose of and means for processing personal information – are required by the POPI Act to ensure compliance with the conditions for lawful processing of personal information, and the measures that give effect to these conditions.

Overview

The Protection of Personal Information Act requires accountability for any processing of personal information.  Heads of public bodies, CEOs of private bodies and the business leaders identified as “responsible parties” who control the purpose and means for processing information are required to ensure compliance with the conditions of lawfully processing personal information set out in the Act.

Business leaders and responsible parties who fail to fulfil their obligations defined in this Act may be charged personally with a criminal offence and face civil claims for damages.

It is the responsibility of the “Responsible Parties” identified by the CEO and listed in the PAIA to ensure that personal information is processed lawfully and in a reasonable manner that does not infringe the constitutional rights of individuals to privacy.

Seminar Objectives

Participants will gain a general understanding of the legal obligations placed on “Responsible Parties”. On completion of this 1 day seminar, participants will be able to:

  • Articulate the requirements of the Protection of Personal Information Act
  • Demonstrate an understanding of the conditions for the lawful processing of personal information
  • Describe the role, responsibilities and legal obligations of the responsible parties.
  • Describe the roles and the responsibilities of the other parties concerned about the processing of personal information
  • Identify the effort required to meet the requirements of the Protection of Personal Information Act and to fulfil the conditions for lawful processing personal information contained therein.

Seminar Outline

Participants will learn through discussion and practical examples how to address the obligations placed on responsible parties by the Protection of Personal Information Act.

This seminar includes topics about:

  • Recording details about Responsible Parties in the PAIA Manual
  • The duties of the Responsible Party
  • Implications of the Companies Act 2008
  • How to differentiate between personal and other data
  • The preparations required prior to updating the PAIA information manual about the processing of personal information
  • Mitigating risks
  • Documentation to be prepared prior to the processing of personal information
  • Processing details to be maintained in the PAIA manual
  • Communicating with data subjects
  • Implications of the conditions for lawful processing of personal information for business activities
  • Controlling the activities of Operators
  • Prior authorisation
  • Working with the Information Regulator
  • Working with the Information Officer
  • The role of Risk Management and Compliance
  • Trans-border exchanges of personal data
  • Consequences of failing to comply
  • Challenges – collection, profiling, cross-marketing, unstructured data, third party processing, secondary use
  • Case studies from industry – local and international
  • An Action Plan to fulfil the obligations of Responsible Parties.

POPI: The Role of INFORMATION OFFICERS

It is the responsibility of the "Information Officer" to encourage their organisation's responsible parties to process personal information lawfully and in a reasonable manner that does not infringe the constitutional rights of individuals to privacy. Information Officers need a sound understanding of the eight conditions for processing personal information and what is reasonable so that they are able to provide advice regarding compliance with the Protection of Personal Information Act.

Overview

The Protection of Personal Information (POI) Act requires head of public oldies and CEOs of private bodies to register with the Information Regulator their Information officers so that data subjects and the Information Regulator can contact, make requests and investigate the lawfulness of the processing of personal information.

Information Officers have specific statutory responsibilities which if not fulfilled have serious consequences, including the possibility of a jail sentence.

This 2 day course will assist Information Officers and Deputy Information Officers understand their role and responsibilities under the Promotion of Access to Information Act (PAIA), the Protection of Personal Information Act and other legislation.

Seminar Objectives

At the conclusion of this course, delegates will be able to:

  • Articulate the impact of the Protection of Personal Information Act on their organisation's activities
  • demonstrate an understanding of the duties and responsibilities of information officers
  • Describe the role, responsibilities and legal obligations of information officers and responsible parties.
  • Describe the roles and the responsibilities of the other parties concerned about the processing of personal information
  • explain the conditions for the lawful processing of personal information
  • Provide advice on complying with the eight conditions for the lawful processing personal information

Seminar Outline

Participants will learn through discussion and practical examples how to advise their CEO and responsible parties.

This seminar includes topics about:

  • Registering Information Officers with the Information Regulator
  • The duties and responsibilities of the Information Officer
  • Designation and delegation to Deputy Information Officers
  • Implications of the Companies Act 2008 for Information Officers and the possibility of Class action
  • How to differentiate between personal information, special personal information and other data
  • t=The content of the PAIA manual and why it is important
  • The preparations required prior to updating the PAIA information manual about the processing of personal information
  • Processing details to be maintained in the PAIA manual
  • Documentation to be prepared prior to the processing of personal information
  • The records that are to be available
  • The conditions for the lawful processing of personal information and their impact on the processing of personal information for business activities.
  • Working with the Information Regulator to conduct investigations
  • Handling requests from data subjects
  • Encouraging Compliance with the provisions of the POPI act
  • Requests to the Regulator by Information Officers to make an Assessment
  • Responding to Information and Enforcement notices
  • Applications to Court regarding decisions of information officers.

Protection of Personal Information Act: Managing Operators

RESPONSIBLE PARTIES ARE LIABLE FOR THE UNLAWFUL PROCESSING OF PERSONAL INFORMATION BY THEIR OPERATORS

The Protection of Personal Information Act stipulates that every public and private body making use of operators must ensure that operators who process personal information for the responsible party, establish and maintain generally accepted information security practices and procedures which may apply to it generally or specifically.

Overview

The Protection of Personal Information Act requires accountability for any processing of personal information. Heads of public bodies, CEOs of private bodies and the business leaders identified as "responsible parties" who control the purpose and means for processing information are required to ensure compliance with the conditions of lawfully processing personal information set out in the Act.

The responsible party must clarify, in written contracts with its operators and other service providers, the services the operators are commissioned to provide. The transfer of personal information to the operator must be limited to what is necessary for the operator to fulfil its contractual obligations.

Operators may not process personal information unless commissioned by responsible parties and the purpose is compatible with the original purpose of collection.

Seminar Objectives

Participants will gain a general understanding of the legal obligations placed on Responsible Parties to manage operators and other service providers. On completion of this 1 day seminar, participants will be able to:

  • Articulate the requirements of the Protection of Personal Information Act when commissioning operators
  • Demonstrate an understanding of how the conditions for the lawful processing of personal information apply to operators
  • Understand the typical content required in written contracts when engaging operators and other service providers
  • Communicate the responsible parties' role and responsibilities to ensure the lawful processing of personal information
  • Understand the need to validate operator procedures.

Seminar Outline

Participants will learn through discussion and practical examples how to commission and manage operators engaged by the responsible parties to provide services that process personal information.

This seminar includes topics about:

  • Why the responsible party must secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable, technical and organizational measures.
  • Why operators may not process personal information unless commissioned to do so and the purpose is compatible with the original purpose for which it was collected.
  • Content of the typical contract between the responsible party and the operators, including details of the technical and organizational measures that the responsible party may have identified as necessary for the operator to establish and maintain to address the internal and external risks to the processing of personal information, as identified by the responsible party.
  • The role and responsibilities of operators and other service providers when processing personal information
  • The technical and organizational capabilities operators are required to have before a responsible party can commission an operator.
  • Governance and management structures and systems to plan, organize, direct and control operators and the services they provide.
  • Verification that the operator has fulfilled its contractual obligations to maintain effective technical.

How to perform assessments of compliance with the POPI Act

AUDITING THE LAWFUL PROCESSING OF PERSONAL INFORMATION

The Protection of Personal Information Act requires compliance with eight conditions for the lawful processing of personal information, including the continuous improvement of the safeguards that give effect to these conditions. Regular auditing of compliance with these eight conditions is an important compensating control that the Information Regulator with consider when investigating reports of non-compliance.

Overview

This 2 day course provides delegates with an understanding of how to lead, plan, execute and report an organisation’s compliance with the eight conditions for the lawful processing of personal information. Delegates will learn about the audit objectives and scope, the audit process, tests to be performed when assessing the current status, the privacy practices and the controls.

Internal audits of the processing of personal information are an important compensating control that the Information Regulator will expect when investigating an interference with an individual’s right to privacy.

This seminar will help participants understand the business risks and audit process that is required to evaluate the processing of personal information and to provide assurance to the responsible parties, information officer and regulator.

Seminar Objectives

Participants will gain an understanding of the requirements of the POPI Act and the audit process to be followed to give assurance.

On completion of this seminar participants will be able to:

  • Demonstrate an understanding on how to lean, plan, execute and report on an audit of conformance with POPI
  • Understand of the POPI Act, its impact on the processing of personal information and the control objectives
  • Demonstrate an understanding of the audit scope and objectives
  • Demonstrate an understanding of the audit process
  • Conduct an audit of the POPI programme, the processing of personal information and the effectiveness of controls
  • Assess compliance with the POPI requirements.

Seminar Outline

Participants will learn through discussion and practical examples how to undertake an audit of the POPI programme, the processing of personal information and the privacy practices and controls necessary for the Protection of Personal information Act.

This seminar includes topics about:

  • Overview of the POPI Act
  • The scope and purpose of an audit of the Protection of Personal Information Act
  • The audit process for assessing POPI
  • Determining the appropriate audit objectives
  • Identifying the scope of the POPI audit and agreeing the audit approach with the responsible parties
  • Fundamental audit concepts and principles
  • Why follow the audit requirements of the ISO 19011 methodology when auditing POPI?
  • Communication during the audit
  • Preparing for a POPI audit
  • Audit test plans for the POPI programme, processing of personal information and the privacy controls
  • Using COBIT to conduct the POPI audit
  • Formulating audit findings
  • Documenting non-conformities
  • Recognising current capability in the processing of personal information
  • An audit of the POPI related documentation
  • Management’s review of the audit findings
  • Reporting to the stakeholders.

POPI: Technical and Organisation Measures for ERP Systems

THE PROTECTION OF PERSONAL INFORMATION ACT REQUIRES ALL PUBLIC AND PRIVATE BODIES TO IMPLEMENT EFFECTIVE TECHNICAL AND ORGANISATIONS MEASURES FOR ERP

A responsible party must ensure that the conditions set out in this Chapter 3 of the Protection of Personal Information Act, and all the measures that give effect to such conditions, are complied with at the time of the determination of the purpose and means of the processing and during the processing itself.

Overview

Enterprise Resource Planning (ERP) systems process a wide variety of business information, including many types of personal information. ERP systems have many features that can assist responsible parties with the protection of personal information. Omitting to use the available features could become a problem when a non-compliance with POPIA is reported to the Information regulator.

Business leaders and responsible parties who fail to fulfill their obligations defined in this Act may be charged personally with a criminal offence and face civil claims for damages.

It is the responsibility of the “Responsible Parties” identified by the CEO and listed in the PAIA to ensure that personal information is processed lawfully and in a manner that does not infringe the constitutional rights that individuals have to privacy.

Seminar Objectives

Participants will gain a general understanding of the legal obligations placed on “Responsible Parties”. On completion of this 1 day seminar, participants will be able to:

  • Articulate the requirements of the Protection of Personal Information Act
  • Demonstrate an understanding of the conditions for the lawful processing of personal information
  • Describe the role, responsibilities and legal obligations of the responsible parties.
  • Describe the roles and the responsibilities of the other parties concerned about the processing of personal information
  • Identify the effort required to meet the requirements of the Protection of Personal Information Act and to fulfill the conditions for lawful processing personal information contained therein.

Seminar Outline

Participants will learn through discussion and practical examples about the typical technical and organisational measures available in ERP systems.

This seminar includes topics about:

  • Overview of the POPI Act requirements for technical and organisational measures to protect personal information and prevent unlawful processing
  • Privacy by design and default
  • Documented privacy-enabling practices and tasks
  • Environmental security
  • Resource protection
  • Random access memory protection
  • Temporary storage, trace and dump file protection
  • Network and data persistence encryption
  • Data dictionary, database security and blocks
  • Accuracy, integrity, completeness and validity checks
  • Pseudonymisation
  • System isolation, unlinkability and intervention
  • PKI and certificate management
  • Logical access control, segregation of duties
  • POPI compliant system development practices
  • System privilege, feature and command restriction
  • Identity management
  • User authentication, authorisation and single sign-on
  • Access permission, privilege management, de-registration
  • Event and incident logs, history, reporting and auditing
  • System updates, patch and change control
  • Records management, information life-cycle management
  • Organisational structures, roles, job descriptions
  • Availability controls and configuration management
  • Supplier management and verification
  • ISO 27001 and Privacy Management Systems.

Safeguards to Protect the Processing of Personal Information

GENERALLY ACCEPTED INFORMATION SECURITY PRACTICES AND PROCEDURES FOR POPI

POPI requires responsible parties to implement generally accepted information security. ISO 27001 is an internationally standard widely recognised as the reference for generally accepted information security practices and procedures. ISO 27001 requires that organisations establish, document, implement and maintain an information management system to protect personal information.

Overview

This 2 day course provides delegates with an understanding of the technical and organisational measures for the protection of personal information using ISO 27001. Delegates also learn about the integrated process approach for information security management and how to extend their current activities in line with international standards.

The Protection of Personal Information Act requires that effective information security be implemented and continuously improved in accordance with generally accepted standards. An ISO 27001 information security management system will ensure that the information security strategy and practices are aligned with the enterprise’s business needs and strategic goals regarding privacy. An appropriate implementation of ISO 27001 will assist responsible parties demonstrate their commitment.

Seminar Objectives

Participants will gain an understanding of the POPIA requirements and how to correctly implement an information security management system using ISO 27001. On completion of this seminar participants will be able to:

  • Demonstrate an understanding of the ISO 27001 specification for Information Security Management and its application to satisfy POPIA
  • Communicate the requirements for ISO 27001 standard
  • Plan the implementation of the safeguards for the protection of personal information in accordance with the needs of the POPI Act and IS 27001.
  • Assist an organization identify and implement the safeguards to protect personal information
  • Assess the extent an organization adheres to the ISO 27001 specification and fulfils the POPI Act requirements.

Seminar Outline

Participants will learn through discussion and practical examples how to design and implement the safeguards required to protect personal information in accordance with the ISO 27000 family of standards for information security management and the Protection of Personal Information Act.

This seminar includes topics about:

  • Overview of the ISO/IEC 27001 specification
  • The scope and purpose of an information security management system in the context of the POPI Act
  • Defining an ISMS policy and framework for setting objectives, risk management and regulatory compliance
  • Understanding an organization’s information security requirements for compliance with the POPI Act
  • Developing and implementing an information security management system to fulfil the requirements of POPI
  • Adopting a process approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organisation's ISMS.
  • Using the "Plan-Do-Check-Act" (PDCA) model for the continuous improvement of information security
  • Implement and operate the generally accepted organisational and technical controls to manage an organization's information security risks in the context of the organization’s overall business risks and the requirements of the POPI Act
  • Monitor and review the performance and effectiveness of information security management for the POPI Act
  • Evaluate the technical and organisational measures against the requirements of the POPI Act
  • Continually improve information security to satisfy the requirements of the POPI Act.

How to use COBIT to implement a compliance framework for POPIA

COBIT is an integrated Governance, Management and Operational process model comprising principles and enablers for processing information lawfully.

Few organisations have the experience and knowledge to effectively and efficiently plan a POPI programme. The COBIT 5 is an internationally recognised framework for the governance and management of information and related technology that can be used for the lawful processing of personal information.

Overview

This 2 day course assists attendees understand how the COBIT 5 enablers can be used to effectively and efficiently plan, organise, direct and control a POPI programme using the COBIT 5 framework. The seven COBIT 5 enablers can enhance the maturity, capability and performance of the protection of personal information within an organisation.

The COBIT 5 principles and enablers provide a set of common dimensions and structured approach to effectively address the conditions for lawfully processing personal information and allows organisations to manage a set of complex interactions between the enablers and successfully implement the technical, organisational, and operational measures that enable the protection of personal information.

Seminar Objectives

Participants will gain an understanding of what should constitute a POPI programme, and how to plan, organise, direct and control the various activities necessary to implement the relevant COBIT 5 principles and enablers. This course will assist participants:

  • Articulate the requirements of the Protection of Personal Information Act
  • Understanding how the conditions for the lawful processing of personal information an be addressed using the COBIT 5 framework
  • Use COBIT5 to determine the roles and responsibilities that responsible parties need to define.
  • Identify the activities that will be necessary and understand who the COBIT 5 framework should be used for the Protection of Personal Information.
  • Identify the effort required to meet the requirements of the Protection of Personal Information Act.

Seminar Outline

Participants will learn through discussion and practical examples how to adapt and use the COBIT 5 principles and enablers to address the business' requirements for the protection of personal information.

This seminar includes topics about:

  • Overview of the requirements for the lawful processing of personal informaiton
  • overview of the COBIT 5 Principles and Enablers
  • The COBIT 5 Governance, management, and operational processes and their importance for the processing personal information lawfully
  • Clarifying stakeholders and their respective needs relating to the lawful processing of personal information
  • Implementing the COBIT 5 Principles to improve the protection of personal information
  • Evaluating the COBIt 5 Enablers and the impact on the lawful processing of personal information
  • Establishing a POPI programme and using the COBIT 5 framework to identify and plan the work packages required
  • Applying the COBIT 5 Implementation methodology for the POPI programme
  • Mapping the conditions for lawful processing of personal information to the ISACA principles for privacy
  • Identifying the COBIT 5 practices appropriate for the lawful processing of personal information
  • Assigning responsibilities to the appropriate organisational functions
  • Measuring, monitoring, and evaluating the POPI programme
  • Using COBIT 5 to continuously improve the POPI programme.

The measures and standards required for the lawful processing of personal information

GENERALLY ACCEPTED INFORMATION SECURITY PRACTICES AND PROCEDURES FOR POPI

POPI requires responsible parties to implement generally accepted information security. ISO 27001 is an internationally standard widely recognised as the reference for generally accepted information security practices and procedures. ISO 27001 requires that organisations establish, document, implement and maintain an information management system to protect personal information.

Overview

This 2 day course provides delegates with an understanding of the International Organisation for Standardisation’s (ISO) standard for information security management – ISO 27001. Delegates will learn about the integrated process approach for information security management and how to extend their current activities in line with international standards.

The Protection of Personal Information Act requires that effective information security be implemented and continuously improved. An ISO 27001 information security management system (ISMS) ensures that the information security strategy and practices are aligned with the enterprise’s business needs and strategic goals regarding privacy. An appropriate implementation of ISO 27001 will assist responsible parties demonstrate their commitment to have properly addressed the POPI requirements.

Seminar Objectives

Participants will gain an understanding of the ISO 27001 standard, its requirements and how to correctly implement an information security management system for POPI. On completion of this seminar participants will be able to:

  • Demonstrate an understanding of the ISO 27001 specification for Information Security Management and its application to satisfy the Protection of Personal Information Act
  • Communicate the requirements for ISO 27001 standard
  • Plan the implementation of an ISO 27001 management system in accordance with the needs of the POPI Act.
  • Assist an organization implement the ISO 27001 requirements for information security management
  • Assess the extent an organization adheres to the ISO 27001 specification and fulfils the POPI Act requirements.

Seminar Outline

Participants will learn through discussion and practical examples how to design and implement information security in accordance with the ISO 27001 requirements for information security management and the Protection of Personal Information Act.

This seminar includes topics about:

  • Overview of the ISO/IEC 27001 specification
  • The scope and purpose of an information security management system in the context of the POPI Act
  • Defining an ISMS policy and framework for setting objectives, risk management and regulatory compliance
  • Understanding an organization’s information security requirements for compliance with the POPI Act
  • Developing and implementing an information security management system to fulfil the requirements of POPI
  • Adopting a process approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organisation's ISMS.
  • Using the "Plan-Do-Check-Act" (PDCA) model for the continuous improvement of information security
  • Implement and operate the generally accepted organisational and technical controls to manage an organization's information security risks in the context of the organization’s overall business risks and the requirements of the POPI Act
  • Monitor and review the performance and effectiveness of information security management for the POPI Act
  • Evaluate the technical and organisational measures against the requirements of the POPI Act
  • Continually improve information security to satisfy the requirements of the POPI Act.