Original Research

Enforcement of the Protection of Personal Information (POPI) Act: Perspective of data management professionals

Agbor T. Kandeh, Reinhardt A. Botha, Lynn A. Futcher
SA Journal of Information Management | Vol 20, No 1 | a917 | DOI: https://doi.org/10.4102/sajim.v20i1.917 | © 2018 Agbor T. Kandeh, Reinhardt A. Botha, Lynn A. Futcher | This work is licensed under CC Attribution 4.0
Submitted: 14 September 2017 | Published: 09 October 2018

About the author(s)

Agbor T. Kandeh, Centre for Research in Information and Cyber Security, Department of Information Technology, Nelson Mandela University, South Africa
Reinhardt A. Botha, Centre for Research in Information and Cyber Security, Department of Information Technology, Nelson Mandela University, South Africa
Lynn A. Futcher, Centre for Research in Information and Cyber Security, Department of Information Technology, Nelson Mandela University, South Africa


Share this article

Bookmark and Share

Abstract

Background: The urgency to enforce the Protection of Personal Information (POPIAct is building up within South Africa, triggered by the appointment of the Information Regulator for POPI on 01 December 2016. However, for data management practitioners, the absence of a practical guideline on how to legally process personal information of employees, customers or other juristic persons in line with the POPI Act poses a day-to-day technical challenge, especially for those embarking on a maiden journey to comply with the POPI Act.

Objectives: The objective of this article is to explore and analyse the unique perspectives of data management professionals who are vested with the responsibility of driving the successful enforcement of the POPI Act within their respective organisations, with the end goal of formulating a practical guideline for the enforcement of the POPI Act.

Method: To achieve the objectives of this research article, semi-structured interviews were conducted with a purposive, convenience sample of 16 data management professionals within companies in South Africa. A recording of their views was obtained through one-on-one interviews and a group interview.

Results: From the semi-structured interviews, group interview and response to the questions, several findings and learnings were elicited. Zooming into these findings showed close similarities in the actions taken by data management professionals operating in a similar industry. Based on these results, a high-level sequence of steps on how to enforce the POPI Act was formulated.

Conclusion: Based on the formulated sequence of steps, it is safe to conclude that the actions of data management professionals can be used to create a practical guideline to enforce the POPI Act. However, to standardise these guidelines across the data management function, there is a need to perform testing with a wider spectrum of data management professionals.


Keywords

POPI Act; privacy; enforcement; data management; information security

Metrics

Total abstract views: 46
Total article views: 25


Crossref Citations

No related citations found.