COVID and POPIA: A perfect storm is brewing With hackers running riot, data security must top C-Suite agenda.

Cybercriminals are increasingly targeting South African businesses as COVID-19 broadens
the attack surface and exposes companies to the vulnerabilities of a digital, remote
workforce and online trading.
With the added pressure of the June 2021 Protection of Personal Information Act (POPIA)
compliance deadline, data security must be top-of-mind for every business – and the
number one priority for the C-Suite.
There’s too much at stake for data governance, risk, and compliance to sit only with the legal
and tech teams. This is a business-wide problem, and it requires the minds and attention of
every senior executive.
Cybercrime scourge
Medical data is 50 times more valuable
on the black market than credit card data. It’s not
surprising, then, that in the middle of a pandemic, there’s a pattern emerging:
- In June 2020, hackers took Life Healthcare Group
’s email servers and admissions
processing systems offline. - In July 2020, a database containing access keys for thousands of patient records
held by medical data start-up LogBox was exposed. - In August 2020, cybercriminals targeted Momentum Metropolitan
, of which
Momentum Health is a part. - Two days later, Experian
, one of the country’s biggest credit bureaus that also offers
a patient verification solution, revealed that the personal details of 24 million South
Africans and 800,000 businesses were compromised in an impersonation attack.
Had POPIA already been in effect, executives at these companies could be staring down
massive penalties and/or jail time – not to mention the reputational damage.
Boardroom agenda item
Protecting personal information is no longer just a legal concern. It’s a technology and
security issue that needs to be managed and driven from the top.
Aside from fines and prison terms, here are other reasons why POPIA needs C-Suite
attention:
- You’re liable even if data is leaked by accident – by you or by a vendor you share
information with. That’s right. You have to worry about the compliance status of every
other business in your ecosystem, not just your own. This is worrying when 60% of
SA businesses experienced a public cloud security incident in the past year. - To add fuel to the fire, the Office of the Information Regulator is under-resourced, under-funded, and lacking sufficient capacity to investigate data breaches. These investigations provide valuable insight into the local threat landscape and how businesses can respond.
Phase 1: C-level conversations
Securing personal information is a complex, time-consuming, and expensive task. But it’s
also not something you can afford to get wrong. We recommend a phased approach,
starting with asking these questions of the C-Suite:
- Have you appointed an Information Officer?
- Do you know exactly where PII is stored across systems, applications, cloud, and on-
premise solutions? - Have you mapped your data by function, process, and critical tasks?
- Have you mapped all systems and applications to critical tasks?
- Do you encrypt sensitive PII data, and do you have clear visibility of this?
- Have you completed a data classification exercise?
- Have you mapped your critical dependencies on third-party IT or data service
providers?
If you answered ‘No’ to any of these questions – but especially the first three – we suggest
that you complete the second phase, a maturity and gap assessment, fast.
Phase 2: Identify the gaps
Once you understand the ‘as is’ state of data privacy in your organisation, you’ll need to
conduct a gap audit. This includes a data discovery exercise to pinpoint exactly where data
resides in the business, and may involve changes to your compliance and audit processes,
policies, and procedures to meet POPIA requirements.
In this phase, which could take up to three months to complete, you’ll identify corrective
action to be implemented in the final phase.
Phase 3: Store, protect, process
Information privacy is about entrenching compliance and processes into the culture and
everyday operations of your organisation. The best way to do this is with an Information Privacy Management System.
In taking a multi-step approach to executing your remedial action plan, you can significantly
improve maturity, achieve alignment, and maintain an audit trail as efforts are rolled out.
Depending on the size and complexity of your business, this phase could take 6-18 months
to complete, and involves everything from data mapping, encryption, and policy
implementation, to incident reporting and privacy awareness training.
There are many moving parts in the POPIA compliance journey. An oversight in one area
can impact every other area of the business and put your data at risk. Don’t leave it to
chance. Get in touch
if you need help, no matter where you are in your journey.
by Ivan Schepers, Sales Manager: MWare & Nicky Downing, CEO: Guideline Biztech
The post COVID and POPIA: A perfect storm is brewing With hackers running riot, data security must top C-Suite agenda. appeared first on MWare.







