03/10/2022
It is your responsibility as the business owner to ensure that all personal information is stored safely and not accessible to individuals that may misuse or share that information for any onerous intent. Here are a few practical steps you can put in place to safeguard personal information:
1. Compile and document a strategy: Formalize an IT security strategy by stipulating how the data is going to be protected (including data backup processes) and identify all the associated or potential risks such as data breaches, lost/stolen PCs/devices, staff leaving with databases etc. Consider how you would mitigate those risks, in other words have a response strategy in place. That way you will be better prepared should something go wrong. This strategy needs to be available, accessible and regularly monitored, reviewed and the safeguards re-addressed if need be.
2. Protect against malware: Secure all PCs, devices and your network through applying a firewall, ensuring passwords are confidential and complex, and that security software protection and antispam software for emails are in place. Enable automatic software updates and security settings on all devices. Ensure that any employees personal PCs/devices (used for business) and those being used for remote working are also secure. If you offer WiFi access, ensure that you use a strong encryption setting and turn off the SSID broadcasting function so as to make your network invisible. It is recommended that you read article 15 in this series Understanding Cyber Security, to gain a greater understanding of how to protect your business against data breaches and cyber attacks.
3. Use the cloud: You may need to consider automating current paper record keeping and disposal systems. It is worth while looking into a reputable cloud service provider that can assist with storing information and implementing security measures. There are many to select from such as Microsoft, Amazon, IBM, Google, SAP, Salesforce, Oracle and many others including local companies with expertise in using these platforms.
4. Inform employees: It is critical that everyone in your business understands the company security policy and it’s importance. Inform and train your staff on the POPIA compliant systems and processes, and ensure that they adhere to treating all information confidentially and with integrity. Regular refresher training is recommended and include this in the induction process for new employees at all levels.
5. Gain consent from those concerned: Ensure that you have the relevant authorization/consent from the respective individual or company to process and store their information, and that they understand what the information will be used for. Only collect the information relevant to the transaction with your business. It is always better to be upfront with your intentions around all data collected.
6. Storage period: Keep personal and confidential information only for as long as you need it. Determine the ‘horizon’ for when this data will no longer be needed, and when the time comes, destroy the data.
7. Destroying records: Carefully consider how best to erase, delete or destroy information when it is no longer justifiable to keep it. This in itself can present a risk so investigate what physical or digital ‘shredding’ and secure data deletion methods best work for your business.