Protection of Personal Information Act (POPIA)

Practical implementation of the requirements of the POPIA

Implementing the POPIA requirements is something that every healthcare practice and bureau must pursue. Confidentiality is only one of the requirements of the POPIA. Therefore, practitioners must understand what needs to be in place to be POPIA compliant. Compliance is not a one-time-box-ticking exercise. A new culture must be established and maintained in the practice.

Understanding the requirements of the act

The first thing to do is to become familiar with the act. A lack of understanding of the act will create dangerous non-compliance, fear or vulnerability to being bullied into acquiring unnecessary products or services. Furthermore, most of the requirements can be implemented by the practice without any assistance from third parties.

Our 90-minute online CPD-accredited course on the provisions of the POPIA provides information that focuses on healthcare practices.

After understanding the requirements of the act, the practice can start with a systematic process of implementation. The POPIA  compliance framework diagram has divided the requirements of the act into four stages of implementation:

1. The establish compliance stage;
2. The collection stage;
3. The compliance continuity stage; and
4. The post-use stage.

Each stage contains specific categories that group requirements together.

GoodX provides step-by-step action maps that summarise the requirements per category. You can download the action maps as a FREE booklet. (The book “An introduction to the protection of personal information in the healthcare practice” included in the above online CPD-accredited course contains detailed information on the items included in the action maps.)