Complying with the POPI Act
using DataSecurity Plus

Section 10

Personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant, and not excessive.

Data discovery:

Permission analysis:

ROT data analysis:

Section 11(4)

If a data subject has objected to the processing of personal information, the responsible party may no longer process the personal information.

Keyword matching:

Response automation:

Section 14(1)

Records of personal information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed.

File analysis:

Section 14(2)

Records of personal information may be retained for periods in excess of those contemplated in subsection (14(1)) for historical, statistical, or research purposes if the responsible party has established appropriate safeguards against the records being used for any other purposes.

File integrity monitoring:

1. Audits every successful and failed attempt to create, read, write, delete, permission change, move, rename, copy, or paste a file—in real time.
2. Maintains a detailed audit trail for detailed analysis and proving compliance with regulatory mandates.

Data security:

1. Triggers instant alerts in the event of a suspiciously high volume of file changes, or if a user modifies a critical file during non-business hours.
2. Blocks attempts to exfiltrate sensitive files via endpoints.

Effective permissions assessment:

Section 14(4)

A responsible party must destroy or delete a record of personal information or de-identify it as soon as reasonably practicable after the responsible party is no longer authorized to retain the record.

Data discovery:

ROT data analysis:

Section 14(6)

The responsible party must restrict the processing of personal information.

Principle of least privilege (POLP):

1. Tracks permission changes, lists effective permissions, identifies files that can be accessed by every employee, finds users with Full control privilege, assesses the vulnerability of files, and more, to aid in implementing POLP.
2. You can generate these permission reports whenever required, or set up report delivery schedules to review file permissions periodically.

Section 15(1)

Further processing of personal information must be in accordance or compatible with the purpose for which it was collected.

Instant alerts, automated responses:

1. Triggers alerts when user activities in file servers, failover clusters, workgroup servers, or workstations violate the configured data handling policies.
2. You can also execute scripts to automatically shut down computers, end-user sessions, or more.

Section 16(1)

A responsible party must take reasonably practicable steps to ensure that the personal information is complete, accurate, not misleading, and updated where necessary.

Data discovery:

1. Uses data discovery to find the data subject's personal information using a unique keyword set, e.g., national identification number, credit card details, email IDs, etc.
2. Provides detailed reports on the personal information's location and the permissions assigned to it.

ROT data analysis:

Section 17

A responsible party must maintain the documentation of all processing operations.

File change monitoring:

1. Audits changes made to files and folders in real time with information on who accessed what file, when, and from where.
2. Provides detailed reports for compliance audits.
3. Maintains a detailed audit trail for further analysis and to fulfill compliance needs.

Section 19(1)

A responsible party must secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organizational measures to prevent—

1. loss of, damage to or unauthorized destruction of personal information; and
2. unlawful access to or processing of personal information.

Permission analysis:

Endpoint data loss prevention:

1. Monitors the use of removable storage devices in endpoints.
2. Blocks the movement of sensitive files to USB devices, or via email as attachments.
3. Prevents accidental data leaks by triggering system prompts about the risk of moving critical data.
4. Reduces incident response times with instant alerts and an automated threat response mechanism.

Ransomware detection and response:

Section 19(2)

The responsible party must take reasonable measures to—

1. identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control;
2. establish and maintain appropriate safeguards against the risks identified.

Data risk assessment:

Endpoint data loss prevention:

Section 22(2)

A breach notification must take into account any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of the responsible party’s information system.

Detailed audit trail:

Section 23(1)

A data subject has the right to—

1. request a responsible party to confirm whether the responsible party holds personal information about the data subject; and
2. request from a responsible party the record or a description of the personal information about the data subject held by the responsible party, including information about the identity of all parties who have, or have had, access to the information.

Data discovery:

1. Locates instances of personal information stored across Windows file servers and failover clusters.
2. Scans for national identification numbers, credit card details, email IDs, and over fifty other types of sensitive personal data using preconfigured data discovery rules and policies.

Security permission analysis:

File access auditing:

Section 24(1)

A data subject may request a responsible party to correct or delete personal information about the data subject in its possession.

Data discovery:

Section 26

A responsible party may not process personal information concerning the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behavior of a data subject, unless authorized under sections 27-31 of POPIA.

Data discovery:

Data risk assessment: