This generic board resolution aims to enable a private or public body (e.g. company, close corporation, partnership), as a responsible party under POPIA, to adopt implementation measures to comply with POPIA and PAIA. It covers:

• Resolve to compliance measures commencing (gap analysis or audit report and high impact assessments being conducted)
• Resolve to recognised head of the body as the automatically appointed information officer
• Resolve to designation and authorisation of information officer (IO) from the head of the body to another person within the body
• Resolve to authorisation of deputy information officer(s) (DIO)
• Resolve to IO's and DIO's registration with the Information Regulator
• Resolve to general duties and responsibilities of the information officer
• Signed by acting chairperson of the board of the body

The document is customisable. Simply purchase and download the document and apply to your organisation. If you require help to customise the document, contact us.

This data breach management policy provides a generic policy guideline for an internal personnel to deal with a data security breach or incident within the organisation and sets out a hierarchic plan and responsibilities for high-level and low-level staff to follow in the event of any perceived data breach; in order to ensure such event is dealt with in a timely manner and in accordance with the law. Therefore, the policy provides for a generic standardised response plan to any reported data breach incident, and assists in providing guidance on what to do in the event of a breach event, ensuring that an incident is appropriately recorded and properly investigated, the impacts are understood, risks identified and action is taken to prevent further damage reducing the risks to your business and assisting in compliance with the law. The standard policy may be customised according to your organisation's specific needs, therefore, simply purchase the policy, customise it, or get us to help you, and apply the policy within your organisation

The Guide provides a comparative overview of the differences and similarities between the European Union’s data protection law – the General Data Protection Regulation (EU) 2016/679 (GDPR) and South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA).  If you are an organisation that may be required to comply with both the GDPR and POPIA this Guide provides a high-level overview of what the fundamental differences and similarities between the two laws and covers:

1. When is compliance with the GDPR and/or POPIA required?
2. What types of processing are covered/exempted?
3. Key data protection concepts and how each concept is addressed under POPIA and the GDPR
4. Recommended guidance steps and how each step is treated under each law

An operator agreement is a legal document signed by the responsible party and the operator either in written or in electronic form, the purpose of which is to regulate the terms and conditions of how the operator shall process personal information about data subjects on behalf of the Responsible Party. Personal data means any information, with the help of which it’s possible to identify a person, for e.g. name, date of birth, place of residence etc. Therefore, if your business uses third party service providers to assist in the processing of personal information of your customers, it is recommended that an operator agreement be put in place to ensure both parties know their scope and purpose of personal data processing; what data is processed and how it should be protected; the relationship between the operator and the responsible party and necessary indemnities and protections, etc. Purchase and download our operator agreement which is drafted to comply with the provisions of POPIA and apply to your business’ third party-operator relationships if personal data protection has not yet been catered for in writing. If you require our help customising the document further, contact us.