Search

Home > Courses > POPIA for tech startups
Courses

POPIA for tech startups

 

“The Protection of Personal Information Act, 2013 (POPIA Act) aims to promote the protection of personal information processed by public and private bodies by, among others, introducing certain conditions for the lawful processing of personal information so as to establish minimum requirements for the processing of such information.” [https://justice.gov.za/inforeg/about.html]

This eight-hour course is designed for tech start-ups, to serve as a guide on the essential compliance requirements and duties created under the Protection of Personal Information Act (POPIA) with regards to the conditions for lawful processing of personal information. This course ultimately aims to provide tech start-ups with an understanding on how to become compliant with the new South African privacy law.

When and where?

27 to 30 September 2021, 9:00-11:00 SAST

This course will be held remotely, most likely on Zoom - exact details will be sent to registered participants a few days before the course.

Course outline

The topics to be covered will include:

a) An Introduction to the Protection of Personal Information Act (POPIA), the Information Regulator

The topics that this section will cover include:

  • What is POPIA?
  • What is personal information and why should it be protected?
  • Other relevant definitions.
  • What are the 8 conditions for lawful processing and what do they require?
  • What are the penalties for non-compliance with POPIA?
  • What does the Information Regulator do and what does it not do (e.g. provision of training)?

b) Key Role Players And Their Responsibilities

The topics that this section will cover include:

  • Responsible Party:

- What are the duties and responsibilities under this role?

- What reporting obligations does the Responsible Party have, when and to whom should reporting be done?

  • Internal Role Players:

- Who will be structuring, implementing and enforcing the 8 principles within the company?

- Who assists these role players in their duties?

  • Joint Responsible Parties:

- Can a Responsible Party and an Operator be the same person and if so, is this advisable?

- What is the relationship between a Responsible Party and an Operator and how does one differentiate between/identify these roles?

  • Operator:

- What are the duties and responsibilities under this role?

- What reporting obligations does the Operator have, when and to whom should reporting be done?

  • External Role Players:

- Who are the 3rd party role players in privacy law terms?

- How to draw up agreements between the Responsible Party and a 3rd party to ensure that the Responsible Party’s liability with regards to the 3rd party’s conduct is limited?

- What to look for when reviewing agreements with 3rd parties to ensure compliance with POPIA?

c) THE 8 POPIA CONDITIONS

This section will involve a discussion on the 8 POPIA Processing Conditions (Accountability; Processing Limitation; Purpose Specification; Further Processing Limitation; Information Quality; Openness; Security Safeguards; and Data Subject Participation).

The lecture will seek to answer the following questions about each of the POPIA Processing Conditions:

  • What is it?
  • What does it require?
  • How does it impact you?
  • What practical steps can you take to comply?

d) Key Actions To Take As A Startup

The topics that this section will cover include:

  • Identifying your relevant legal roles and those of your operators.
  • Identifying your Information Officer (process and requirements) and appointing Deputy Information Officers.
  • Performing a risk assessment.
  • Mapping out your data subjects; personal information; lawful bases; processing purposes and security safeguards.
  • Drafting and rolling-out requisite policies.
  • Entering into appropriate contractual agreements.
  • Updating of existing contracts with data protection clauses.
  • Assessing where you store personal information and what consents you have obtained for cross-border transfers of personal information.

e) The Key Legal Agreements That You Should Consider And What They Are

The topics that this section will cover include: -

  • Organisational Privacy Policies;
  • Organisational Information Security Policies;
  • Data Breach Notification Policies;
  • Confidentiality and Non-Disclosure Agreements;
  • External Privacy Policies;
  • Data Processing Agreements.

Who will benefit from this course?

The following stakeholders will benefit from this course:

  • In-house legal counsel;
  • Directors/heads of tech start-ups;
  • Management level of tech start-ups

Presenters

This course is presented in conjunction with Endcode. EndCode is a tech law advisory that specialises in assisting startups in navigating the legal frameworks that impact their businesses. We are proud legal mentors for tech startups at the Innovation Hub in Pretoria and the pan-African Meltwater Entrepreneurial School of Technology (MEST).

How much?

R2,200 per person

Certificate

A certificate of attendance from UCT will be awarded to students who attend the full course.

How to sign up

Complete and submit the registration form. You will then be given the payment information. Please note that registrations will not be accepted until payment has been made.

One or two days before the course, we will send you the Zoom link. You will need to register and use a password to enter the virtual classroom.

Registrations close three days before the course starts.

Download the brochure.

You may also be interested in: