2. SA Constitution Sec 14 – Privacy – RICA – POPI Sec 32 – Access to Information – PAIA – POPI

3. Relevant Legislation NCA CPA ECT Act

4. KING III 5.5.2The board should ensure that the company complies with IT laws and that IT related rules, codes and standards are considered. 5.6.1The board should ensure that there are systems in place for the management of information which should include information security, information management and information privacy.

5. KING III 5.6.2The board should ensure that all personal information is treated by the company as an important business asset and is identified.

6. Standards and Codes ISO 27001 ISO 29100 WASPA Code of Conduct DMA Code of Conduct

7. NB DEFINITIONS Personal Information Process(-ing) Responsible Party Operator Data Subject Consent Child

8. 8 CORE CONDITIONS Accountability Processing Limitation Specific Purpose Further Processing Limitation Information Quality Security Safeguards Data Subject Participation

9. ADDITIONAL CONCERNS Special Categories of Personal Information Unsolicited Marketing Automated Processing Cross Border Data Transfers Regulator

10. ADDITIONAL CONCERNS Special Categories of Personal Information Unsolicited Marketing Automated Processing Cross Border Data Transfers Regulator

11. CLOUD COMPUTING Is moving data to the CLOUD a bad thing?

12. CLOUD COMPUTING Will my company have continued access to its information or data (backup and disaster recovery measures) irrespective of the information or data’s location?

13. CLOUD COMPUTING Can you provide me with assurances that unauthorised access to my company’s information or data is prevented (covers both protection against external “hacking” attacks and access by the cloud provider’s personnel or by other users of the datacentre)?

14. CLOUD COMPUTING Do you have adequate oversight of any sub- processors (irrespective of their location) you use or might use and subsequent to that, do you have the necessary agreements and contracts in place to ensure the security of my company’s information or data?

15. CLOUD COMPUTING Do you have sufficient procedures in place in the event of a data breach that would enable my company to take the necessary actions in terms of POPI?

16. CLOUD COMPUTING Could you provide my company with a guarantee in the contract that it will have the right to remove or transfer its information or data at any time?

17. © Copyright Francis Cronje 2010-2012 - All Rights Reserved