Accountability is critical for any privacy programme to succeed. It is important for organisations to determine their view of privacy and how they plan to comply with the regulatory requirements. Based on this, agree on a number of key objectives that can be further developed into a strategy and framework to drive the implementation project.

Allocate the Privacy Officer role

By default, the head of the organisation is the Privacy Officer. However, the POPIA allows for this role to be delegated. Decide now who will be responsible – will it be the Compliance Officer, Head of Risk or somebody else in the organisation? Take this individual on the journey from the start.

Follow a risk-based approach

Many the POPIA programs have been derailed due to teams trying to implement the requirements of the POPIA without considerations of their unique business context. A risk-based approach to the POPIA compliance, agreed with the Board or Steering Committee, will ensure focus remains on prioritising the most important the POPIA compliance requirements first.

Integrate with existing compliance structures

the POPIA is a compliance requirement and much effort can be saved by integrating it into existing compliance structures and processes, such as compliance management, risk management, internal audit and audit and risk committee reporting. Without an appropriate compliance process in place, it may be challenging for organisations to drive the POPIA in isolation.

Align with other initiatives

It is important to coordinate your the POPIA initiatives with related initiatives within your organisation, particularly in areas such as cybersecurity, data classification and PCI compliance to avoid unnecessary duplication of effort and ensure alignment to business objectives.

Drive behavioural change through training and awareness

Change management is a critical part of embedding privacy into the culture of the organisation. Through training and awareness, the culture of the organisation can embrace change in how they handle data, which then results in changed behaviours.

Get help outside the organisation

Develop a risk-based and prioritised implementation plan. Look inside for skills, but reach out for assistance from professionals, such as those with multi-disciplinary teams between privacy, legal, data, advisory and cyber security specialists where you don’t have the skills within your organisation.