<!-- wp:paragraph -->

<p><strong>By: Danelle van Heerde, Head of Advice Solutions at Sanlam</strong></p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>Cyber-attacks are on the rise during lockdown, increasing from the norm of <a href="https://www.iol.co.za/technology/software-and-internet/spike-in-cyberattacks-as-cyber-criminals-exploit-covid-19-lockdown-report-46424508" target="_blank" rel="noreferrer noopener">30 000 daily to 310 000</a> recorded on the 18 March as criminals exploit the unsecured home networks used by millions of office workers who are now operating remotely. The Protection of Personal Information (POPI) Act aims to mitigate some of the risk with additional disclosures and increased security around access to client data. The POPI Act came into effect on 1 July 2020 giving all companies, including financial service providers and intermediaries, until 30 June 2021 to comply.</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>Danelle van Heerde, Head of Advice Solutions at <a href="https://www.sanlam.co.za/" target="_blank" rel="noreferrer noopener">Sanlam</a>, notes that intermediaries must ensure third party vendors have the proper security in place to protect against data breaches and ensure that their client information is stored securely.</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>“The POPI Act supports the trust relationship between client and intermediary by creating a transparent process,” says van Heerde. “Clients give intermediaries access to a host of personal information, so it is imperative that clients trust that their information is safe and that it is only used for the specific purposes disclosed to them.”</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>After meeting with a new client for the first time, intermediaries must ensure they have permission to continue the relationship and to communicate with the client. Clients must also have the option of opting out or unsubscribing from email newsletters or marketing communications.</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>Processing relates to any activity concerning personal information and includes any operation or set of operations connected to that information. This can be lawfully done if the 8 conditions listed in the Act below are met:</p>

<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true,"type":"1"} -->

<ol type="1"><li><strong>Accountability</strong></li></ol>

<!-- /wp:list -->

<!-- wp:paragraph -->

<p>Intermediaries must ensure all the provisions of applicable data protection laws are complied with and remain accountable even when third parties are used to process personal information on their behalf.</p>

<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true,"type":"1","start":2} -->

<ol type="1" start="2"><li><strong>Processing limitation</strong></li></ol>

<!-- /wp:list -->

<!-- wp:paragraph -->

<p>Data can only be processed lawfully with consent from the client or with legal justification, for example where necessary to conclude a contract or to meet a legal obligation. Only data relevant to the purpose may be processed.</p>

<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true,"type":"1","start":3} -->

<ol type="1" start="3"><li><strong>Purpose specification</strong></li></ol>

<!-- /wp:list -->

<!-- wp:paragraph -->

<p>The purpose for which data is collected must be specific, explicitly defined and legitimate. Clients must be informed of the purpose for which their personal information is collected.</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>Personal information may not be kept for longer than is necessary than required to achieve the purpose, unless required by law, e.g. to meet the requirements of the FAIS Act.</p>

<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true,"type":"1","start":4} -->

<ol type="1" start="4"><li><strong>Further processing limitation</strong></li></ol>

<!-- /wp:list -->

<!-- wp:paragraph -->

<p>Any further processing of personal information must be compatible with the purpose for which it was collected.</p>

<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true,"type":"1","start":5} -->

<ol type="1" start="5"><li><strong>Information quality</strong></li></ol>

<!-- /wp:list -->

<!-- wp:paragraph -->

<p>Reasonably practical steps must be taken to ensure that the personal information is complete, accurate, not misleading and updated where necessary.</p>

<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true,"type":"1","start":6} -->

<ol type="1" start="6"><li><strong>Openness</strong></li></ol>

<!-- /wp:list -->

<!-- wp:paragraph -->

<p>Clients must be aware that the responsible party is collecting their personal information, the purpose of collection and the consequence of not providing information.</p>

<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true,"type":"1","start":7} -->

<ol type="1" start="7"><li><strong>Security Safeguards</strong></li></ol>

<!-- /wp:list -->

<!-- wp:paragraph -->

<p>Reasonable precautions must be taken to secure the integrity and confidentiality of personal information and prevent loss, damage or unlawful access.</p>

<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true,"type":"1","start":8} -->

<ol type="1" start="8"><li><strong>Data subject participation</strong></li></ol>

<!-- /wp:list -->

<!-- wp:paragraph -->

<p>Clients may ask a responsible party to confirm whether their personal information is held, for detail of the information held and any third parties who may have accessed it and to correct or delete personal information.</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>“If you manage a small business or brokerage, ensuring POPI compliance can be cumbersome. You may benefit from partnering with compliance experts to implement legislation and evaluate whether your third-party vendors are compliant as well,” notes Van Heerde.</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>Until recently, companies did not have a legal obligation to inform their clients when their data had been compromised. Under the new POPI act, companies have a legal obligation to inform their clients when data has been compromised or face a hefty fine of up to R10 million.</p>

<!-- /wp:paragraph -->

<!-- wp:paragraph -->

<p>Overall, the POPI act has highlighted the importance of securing personal information both for clients and intermediaries. “Intermediaries should welcome additional disclosures as an opportunity to further strengthen the trust of their clients,” concludes van Heerde.</p>

<!-- /wp:paragraph -->