Towards a Privacy Compliance Assessment Toolkit

The South African Protection of Personal Information Act (POPIA) No.4 of 2013 makes it illegal to collect, use, process or store personal information unless it is done in accordance with the prescribed legal and regulatory clauses enshrined in the Act. Organisations should take stock of the personal information they collect and who they share it with before they can put controls in place to safeguard it. Failure to comply with POPIA may potentially expose the responsible party and its associated third parties to steep legal penalties including possibly imprisonment of up to 10 years or R10 million fine which is imposed by the Information Regulator of South Africa. This paper presents the results of a system called Protection of Personal Information Act Compliance Assessment Toolkit (PCAT). The PCAT’s objective is to assist organisations to assess their current state of compliance to POPIA. The PCAT followed an experimental research and development process, where three existing similar technologies in the market were analysed and compared to the PCAT. The results show that it simplifies the POPIA compliance requirements compared to the other three existing technologies.