Why POPIA is good for data strategy

The moment has arrived: last week the Protection of Personal Information Act (POPIA) came into force. It hasn’t been sprung on us; the process has been ongoing and businesses have been anticipating their compliance obligations for years.

POPIA, much like the General Data Protection Regulation (GDPR) in the EU, exists to support the protection of personal information processed by public and private organisations. There are strong penalties for noncompliance.

Now that the Act is live, there are several ramifications for businesses, but a few – anecdotally at least – have given executives more sleepless nights than others. Companies must allow data subjects to object to their data being processed, as well as have the right to revoke previously given consent at any time. When a company receives this withdrawal of consent it needs to stop processing that subject’s data immediately.

Beyond this, if there is no longer a demonstrable need to process data, in other words, if there is no need to actively use the data for what was initially intended when the subject gave express permission, the company loses the right to hold onto that data unless required to do so by law.

In addition, organisations must take reasonable steps to ensure the personal information in their possession is accurate and not misleading, they must maintain records of data processing while also taking steps to ensure that the data subject is aware of which information is being stored. Data subjects also need to be able to access their personal information and update it.

Security is an important part of POPIA. Organisations need to ensure the safety and integrity of the data they process, and they have the responsibility to ensure that providers that process data maintain security standards. They must also notify the authorities as soon as is reasonably possible in the event of a breach or compromise.

In a nutshell, businesses are accountable for ensuring the lawful processing of data. Of course, there will be teething issues, even though POPIA was promulgated in November 2013. It is live and enforceable from 1 July this year.

As a multinational Modern Data Protection business, Veeam has seen, and experienced first-hand, the effects of regulation abroad, such as GDPR, and how it has affected the way companies manage data. One of main lessons was that the companies that started their preparation long in advance were in a better position once that legislation went live, but perhaps the biggest lesson was the need to evolve towards modernising data backup and protection.

Modern Data Protection in the POPIA era, much like it has been since GDPR went live, involves companies knowing their data, managing the data, properly securing and protecting the data, being on top of documentation and compliance, and continually improving the efficiency of their systems.

Modern data management is increasingly geared toward achieving certain business outcomes such as efficiency, competitiveness, and increased revenue for businesses. Mass migration into the cloud is enabling businesses to make use of a myriad of applications and technologies to help them achieve these outcomes.

Because of this, businesses have larger and more diverse pools of data to manage, and with that an increased need to have the data available, secure, and useable. To compound matters, they must retain customer trust in a world where cyberattacks are on the increase. They do this by deploying a strong, compliant foundation of data backup and intelligent data recovery.

Essentially, Modern Data Protection should be built on the fundamentals of best practice, many of which are reflected in regulations.

Two former industry analysts, who have joined Veeam as Vice Presidents, Jason Buffington, and Dave Russell, held an interesting conversation in a Veeam series about modern data management where they noted that regulation merely sped up, and added budget to, activities that should be undertaken by responsible companies anyway.

They said that in their combined experience, and certainly something we can attest to on this continent, IT teams are aware of areas where inadequacies lead to missed service level agreements. It’s not uncommon to hear IT departments say that they are expected to do more with less. Regulation, the two executives say, brings all stakeholders to the table and things that should have been a priority from the beginning, then get a timeline and funding.

This is not an “I told you so” observation. Rather, it means that responsible data custodianship should already comprise much of what regulation aims to formalise.

Regulation, much like we have seen with GDPR, and more recently with POPIA, means that an enterprise’s data strategy must have a strong focus on modern data protection. With regulatory requirements looming, executives have asked how this perceived extra requirement would be enabled, whereas by deploying a modern platform that achieves high backup success, properly secures data, and the ability to restore rapidly, they’d have met a substantial proportion of regulation compliance anyway. Things such as the right to be forgotten, for instance, are built into modern platforms.

Buffington and Russell argue, correctly, that most regulations around the world don’t require entirely overhauled practices because Modern Data Protection platforms are doing them already and are always evolving.

Seen this way, being forced to address data management, albeit with the spectre of POPIA, forces enterprises to rethink their strategies and implement new Modern Data Protection tools and policies, that if done correctly and with the right partners, improve operations and unlock new business value – all while being compliant. That’s a win-win scenario for data subjects and businesses.