The PoPI Act creates new areas of focus for compliance and management, covering a wide range of privacy and data protection topics, but is still in its infancy.
As more interpretations are forthcoming, and as one’s own business model changes over time, POPITOOLS enables an organisation to update their standards and generate new assessments and related documents.
POPITOOLS covers the 8 Conditions for processing.
What is covered in POPITOOLS?
1. Accountability
• Lawful Processing
• Minimality
• Consent
• Consent Withdrawal
- Provision of Information
- Processing Limitation
- Information Processed
- Data subjects aware of purpose of processing
- Data Retention Periods
- Data retention requirements
- Data subject request for destruction of personal information
- Notification of destruction of data to third parties
- Objection to processing
- Notification of destruction of data to third parties
- Information Quality
- Request for Correction
- Notification to data subject when collecting personal information
- Information processed by operators or third parties
- Security measures for operators and third parties
- Security measures on integrity and confidentiality of information
- Security and Policy Breaches
- Security measures
- Breach Response
- When do individuals need to be told about a data breach?
- What information must be provided to individuals when telling them about a breach?
- Specified Data Subject Rights
- Special Personal Information
- Information on Minors
- Direct Marketing Consent
- Automated Processing
- Cross Border transfer of information
- Data Subject Request Template
Detailed Reporting
The POPITOOLS assessment results are scored on a scale of 0 to 3. A value of 0 indicates that you have marked a response as “not applicable” to your business. Values of 1 to 3 indicate the level of measures, controls, documents, processes, or actions that have been taken.
