POPIA and your software vendor

The Protection of Personal Information Act, known as POPIA, has been fully enforceable since 1 July 2021. It applies to a plumber with a customer list as much as to a bank. If your accounting, payroll, HR or CRM software holds names, ID numbers, addresses, bank details or salaries, the Act applies to how you choose and use it.

You are the responsible party

POPIA calls the business that decides why and how personal information is used the responsible party. That is you. A software vendor that stores and processes that information on your behalf is an operator. You stay accountable for what an operator does with your data, which is why the choice of vendor is yours to defend.

What the Act asks in practice

• A written contract with every operator, requiring it to keep the information secure and to tell you if it is compromised.
• Reasonable security safeguards for the personal information you hold.
• Notifying the Information Regulator, and the people affected, if their information is accessed or acquired without authority.
• Restrictions on sending personal information outside South Africa, which allow it in set circumstances, such as where the recipient is bound by protection comparable to POPIA.
• An information officer for the business, registered with the Information Regulator. In a small business the owner usually holds this role.

Questions to put to the vendor

1. Where is my data stored: which country, and which provider hosts it?
2. Will you sign an operator agreement, or does your standard contract already contain one?
3. Which other companies handle my data on your behalf, and can I see the list?
4. How quickly will you tell me about a breach, and how?
5. Who at your company can see my customers' data, and how is that access controlled and logged?
6. How do I turn on two factor sign in and limit what each of my users can see?
7. How long do you keep my data after I cancel, and how do I have it deleted?
8. Do you use my data for anything other than running my account?

What the register can and cannot tell you

The register records prices, plans, compliance features the vendors state and the banks they feed from. It does not record where each vendor stores data or what its contracts say. Many vendors publish a security or trust page that answers some of the questions above. Read it, and put the rest in writing. How to ask for a quote covers the same habit for prices.

What to write down

A small business does not need a long policy, but it does need to be able to say what it holds and why. A page that answers these is a good start, and it is the first thing a regulator or a customer will ask for.

• What personal information you collect, and from whom: customers, suppliers, employees.
• Why you collect it, and who in the business can see it.
• Which software holds it, and where that software stores it.
• How long you keep it, and how you delete it.
• Who the information officer is, and how a person can contact them.

If something goes wrong

1. Contain it: change passwords, remove access and ask your vendor what happened.
2. Find out what was exposed, and whose information it was.
3. Notify the Information Regulator and the people affected as soon as reasonably possible, as the Act requires.
4. Write down what happened and what you changed, and keep the record.

Payroll and HR carry more risk

Payroll and HR software holds ID numbers, bank details, salaries and often health information such as sick leave notes. Some of that is special personal information under the Act, which carries stricter rules. If you choose a product for either, take the security questions more seriously and ask for them first. See a payroll software checklist.

Marketing and your CRM

If you use a CRM or an email tool to market to people, POPIA limits unsolicited electronic marketing. In general you need a person's consent, except where they are an existing customer and you are marketing similar products with an easy way to opt out. Check that your software records consent and handles unsubscribes properly.