IRFA & ASISA Training 8 July 2022 | Protection Of Personal Information Act (POPIA) Workshop

The following summarises the Learning Areas and Learning Outcomes covered in this workshop:

PROTECTION OF PERSONAL INFORMATION ACT (POPIA) (½ day – 3 hours)

Learning Area Learning Outcomes - By the end of the workshop delegates will be able to…

Origins and objectives of the legislation

• Show how POPIA is rooted in our constitution.
• Describe the history of use, abuse, and loss of personal information in society.
• Explain the relevance and purpose of the legislation for society.
• Explain the relevance and purpose of the legislation for the retirement fund industry.
• Describe the objectives and broad design of their fund’s POPIA policy.

Definitions

Provide a definition of the following:

-  Data subject

-  Responsible party

-  Operator

-  Information regulator

-  Information officer

-  Personal information

-  De-identify/ de-identified & Re-identify/ re-identified

-  Processing

-  Record & filing system

Conditions

• List and describe the application of the 8 conditions for processing personal information to their retirement fund.
• Analyse how each condition applies to service providers and how SLAs should be amended
• Show what constitutes compliance by Service Providers.
• Design methods of communication with Fund members to comply with the conditions.

Governance implications for Retirement Funds

• Describe the responsibilities for each of the following role players:

         -   Trustees

         -   Principal Officers

         -   Service providers

• Explain the consequences for each stakeholder of not fulfilling their responsibilities
• Explain the role and responsibilities of the Information Officer
• Design the mandate for the party appointed as Information Officer
• Describe the rights and obligations of fund members
• Identify the risks associated with non-compliance and the implications for each of the role players
• Show the basis on which fines and penalties for non-compliance are imposed

Timelines for implementation

• Know the deadline/s for implementation
• Show what has to be in place by each deadline
• Describe the implications for their fund and other role players (other funds and service providers) not complying by the deadline/s